我的托管身份支持的 azure 函数如何访问共享点？

Question

我有一个由托管身份支持的天蓝色功能。

在同一个 AD 上，有 Office 365 和名为“demonews”的 SharePoint 网站。

如何向“demonews”组添加权限/添加托管标识，以便它可以访问 SharePoint API？

我尝试在SharePoint网站上添加成员，我尝试在AD组上添加成员。下拉列表中未找到托管身份。

Answer 1

我认为这就是您正在寻找的：

https://finarne.wordpress.com/2019/03/17/azure-function-using-a-management-identity-to-call-sharepoint-online/

基本上，您将获得 Office 365 SharePoint 的 azure 服务主体以及角色。

#Get the sharePoint principal
$sharePoint = (Get-AzureADServicePrincipal -SearchString “Office 365 SharePoint”).ObjectId

#Get the Roles for that principal
$appRoles = Get-AzureADServicePrincipal -SearchString “Office 365 SharePoint” | %{$_.AppRoles}

#Find the specific role
$appRole = AppRoles.Where({ $_.Value -eq "Sites.Manage.All" }

#You will also need to get the service principal for your function app

#Get the function app object id
$myfunctionapp = (Get-AzureADServicePrincipal -SearchString “myfunctionapp”).ObjectId

#assign the role to the MSI for the sharepoint resource
New-AzureADServiceAppRoleAssignment -ObjectId $myfunctionapp -PrincipalId $myfunctionapp -ResourceId $sharePoint -Id $appRole

然后，您可以使用本地 MSI 端点和密钥来获取令牌。

Answer 2

创建令牌时出现以下错误 "statusCode":500,"message":"获取 AAD 令牌时发生意外错误

我点击了下面的链接 https://finarne.wordpress.com/2019/03/17/azure-function-using-a-management-identity-to-call-sharepoint-online/