在 Azure Powershell 中编写委派权限代码

Question

任何人都可以给我一个在 Azure Powershell 中对应用程序的委派权限进行编码的示例吗？下图显示了我希望的权限的示例。

我知道我应该使用此链接中看到的“oAuth2PermissionGrant”：https://learn.microsoft.com/en-us/graph/api/oauth2permissiongrant-post?view=graph-rest-1.0&tabs=powershell

但我还没有正确使用它。谁能举个例子吗？

Answer 1

您可以使用以下示例 PowerShell 脚本将 Delegate 类型的 Microsoft Graph 和 Azure Service Management API 权限添加到应用程序注册中：

# Define the list of delegated permissions names
$delegatedPermissions = @(
    "AuditLog.Read.All",
    "Directory.Read.All",
    "User.Read.All",
    "offline_access",
    "Group.Read.All",
    "GroupMember.Read.All",
    "GroupMember.ReadWrite.All"
)

# Get Microsoft Graph service principal
$msGraphSP = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Graph'" -Property Oauth2PermissionScopes | Select -ExpandProperty Oauth2PermissionScopes
$filteredPermissions = $msGraphSP | Where-Object { $delegatedPermissions -contains $_.Value }

# Define Azure Service Management API permission
$azureServicePermission = @{
    resourceAppId = "797f4846-ba00-4fd7-ba43-dac1f8f63013"
    resourceAccess = @(
        @{
            id = "41094075-9dad-400e-a0bd-54e686782033"
            type = "Scope"
        }
    )
}

$appObjId = "your_app_reg_ObjectID"

$params = @{
    requiredResourceAccess = @(
        $azureServicePermission,
        @{
            resourceAppId = "00000003-0000-0000-c000-000000000000"
            resourceAccess = $filteredPermissions | ForEach-Object {
                @{
                    id = $_.Id
                    type = "Scope"
                }
            }
        }
    )
}

Update-MgApplication -ApplicationId $appObjId -BodyParameter $params

回复：

为了确认这一点，我在 Azure AD 应用程序中检查了相同的内容，其中委托权限已成功添加，如下所示：

要将 管理员同意 添加到 Microsoft Graph 权限，您可以使用以下示例脚本：

$params = @{
    clientId = "service_principal_ObjID"
    consentType = "AllPrincipals"
    resourceId = "54858dc8-ace7-47d4-82b2-e74d83062e7b"
    scope = "AuditLog.Read.All Directory.Read.All User.Read.All offline_access Group.Read.All GroupMember.Read.All GroupMember.ReadWrite.All"
}

New-MgOauth2PermissionGrant -BodyParameter $params

回复：

要将管理员同意添加到Azure服务管理权限，您可以使用以下示例脚本：

$params = @{
    clientId = "service_principal_ObjID"
    consentType = "AllPrincipals"
    resourceId = "65805703-c2cf-48a5-8835-e8d233b234e3"
    scope = "user_impersonation"
}

New-MgOauth2PermissionGrant -BodyParameter $params

回复：

当我在门户中检查相同内容时，管理员同意已成功授予所有权限，如下所示：