通过PowerShell访问MS Graph API的权限

Question

我的剧本

$azContext = Get-AzContext
$token = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate(
    $azContext.Account,
    $azContext.Environment,
    $azContext.Tenant.Id,
    $null,
    [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never,
    $null,
    "https://graph.microsoft.com"
)

$params = @{
    Method  = "GET"
    Uri     = "https://graph.microsoft.com/beta/reports/credentialUserRegistrationDetails"
    Headers = @{
        Authorization  = "Bearer $($token.AccessToken)"
        "Content-Type" = "application/json"
    }
}
Invoke-RestMethod @params

回应

{
  "error": {
    "code":"Authentication_MSGraphPermissionMissing",
    "message":"Calling principal does not have required MSGraph permissions Reports.Read.All",
    "innerError": {
      "date":"2021-10-19T01:18:36",
       "request-id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
       "client-request-id":"6b8cc3a3-b93b-44bb-b1d4-190c618aa52a"
    }
  }
}

Answer 1

当我使用Graph Explorer时，只要我在修改权限（预览）选项卡上启用reports.read.all，它就能正常工作。

这是因为Microsoft Graph Explorer是Microsoft的企业应用程序，每个Azure广告租户都有，只需通过提供所需的权限登录并使用即可。

但是在编写运行Powershell脚本时，它使用Microsoft Azure Powershell。您可以通过检查JWT token中接收的access_token来验证它。因此，您需要向您的租户中的相同应用程序提供reports.read.allAPI权限，该租户具有appid:1950A258-227B-4E31-A9CF-717495945FC2in Enterprise Application>>权限，并授予管理员同意。

另一种方法是创建应用程序注册，为其创建客户端机密，然后提供reports.read.allAPI权限，并使用以下脚本：

$TenantName = "tenantname.onmicrosoft.com"
$clientID = "d344e3xxx-xxx-xxxx-xxxx-9c861d363244" # app registration clientId
$clientSecret = "fNc7Q~UNHBgv_xxxxxxxxxxxxxxxxxxxxxx-PD"
$Scope = "https://graph.microsoft.com/.default"
 
$Body = @{
    Grant_Type = "client_credentials"
    Scope = $Scope
    client_Id = $clientID
    Client_Secret = $clientSecret
}
$authUri = "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token"
  
$TokenResponse = Invoke-RestMethod -Uri $authUri -Method POST -Body $Body

$Headers = @{
        "Authorization" = "Bearer $($TokenResponse.access_token)"
        "Content-type"  = "application/json"
    }
$apiUri = "https://graph.microsoft.com/beta/reports/credentialUserRegistrationDetails"
$response = Invoke-RestMethod -Headers $Headers -Uri $apiUri -Method GET
 
$response.value

产出：

注意：在某些租户中，Microsoft Azure PowerShell可能无法从portal中看到，因此在这种情况下，请使用上面的解决方案会更容易。