通过PowerShell为Entra组分配角色并限定到管理单元的问题

1. 「Invalid GUID」错误原因及修复 #

错误核心是变量取值类型错误：

• New-MgGroup | Select Id 和 Get-MgDirectoryAdministrativeUnit | Select Id 返回的是包含Id属性的对象，而非纯字符串GUID；
• 当这些对象直接赋值给principalId或用于字符串拼接时，PowerShell会将其转换为@{Id=xxx}格式的字符串，导致GUID验证失败。

修复方式（二选一）：

• 使用Select -ExpandProperty Id直接提取GUID字符串；
• 通过.Id属性直接访问对象中的GUID值。

示例修改：

# 创建角色组并提取ID
$Id = New-MgGroup -DisplayName $Name -MailEnabled:$False -MailNickName $NickName -SecurityEnabled -IsAssignableToRole -Visibility "Private" | Select -ExpandProperty Id
# 获取管理单元ID
$AdminUnit = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq '$AuName'" | Select -ExpandProperty Id

# 更简洁的写法
$Id = (New-MgGroup ...).Id
$AdminUnit = (Get-MgDirectoryAdministrativeUnit -Filter ...).Id

2. directoryScopeId字符串拼接的正确用法 #

原代码的拼接逻辑本身没问题，但因$AdminUnit是对象导致格式错误。修复$AdminUnit为纯GUID字符串后，两种写法都可正常工作：

# 格式化字符串写法
directoryScopeId = "/administrativeUnits/{0}" -f $AdminUnit
# 直接变量插入写法（更简洁）
directoryScopeId = "/administrativeUnits/$AdminUnit"

3. 高效实现优化方案 #

3.1 批量预获取管理单元ID #

避免循环中重复调用Get-MgDirectoryAdministrativeUnit，先一次性拉取所有需要的管理单元并存入哈希表，循环时直接取值：

# 提取CSV中所有唯一的管理单元名称
$auNames = $GroupList.AU | Select-Object -Unique
$adminUnits = @{}

# 批量查询管理单元并构建名称-ID映射
Get-MgDirectoryAdministrativeUnit -Filter "DisplayName in ('$($auNames -join "','")')" | ForEach-Object {
    $adminUnits[$_.DisplayName] = $_.Id
}

# 循环中直接从哈希表取ID
foreach ($Group in $GroupList) {
    $AdminUnit = $adminUnits[$Group.AU]
    # ... 后续逻辑
}

3.2 批量角色分配（适用于大量数据） #

通过Microsoft Graph批量请求减少API调用次数，降低延迟：

$batchRequests = @()
$requestId = 0

foreach ($Group in $GroupList) {
    $groupId = (New-MgGroup ...).Id
    $adminUnitId = $adminUnits[$Group.AU]
    
    $batchRequests += @{
        id = $requestId++
        method = "POST"
        url = "/roleManagement/directory/roleAssignments"
        body = @{
            "@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
            roleDefinitionId = "c4e39bd9-1100-46d3-8c65-fb160da0071f"
            principalId = $groupId
            directoryScopeId = "/administrativeUnits/$adminUnitId"
        } | ConvertTo-Json
        headers = @{ "Content-Type" = "application/json" }
    }
}

# 发送批量请求
Invoke-MgGraphRequest -Method Post -Uri "/$batch" -Body @{ requests = $batchRequests } | ConvertTo-Json

3.3 错误捕获与日志 #

添加异常处理，避免单个任务失败中断整个流程，并记录错误信息：

foreach ($Group in $GroupList) {
    try {
        # ... 现有逻辑
        Write-Host "成功处理组: $Name"
    }
    catch {
        Write-Error "处理组 $Name 失败: $_"
        "[$(Get-Date)] 处理组 $Name 失败: $_" | Out-File "批量处理错误日志.txt" -Append
    }
}

完整修复后的代码 #

Import-Module Microsoft.Graph.Identity.Governance
Import-Module Microsoft.Graph.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Authentication
Connect-MgGraph -Scopes "Group.ReadWrite.All,RoleManagement.ReadWrite.Directory" -Tenant "TenantId"

$GroupList = Import-CSV -path "PathHere"

# 预获取所有需要的管理单元ID
$auNames = $GroupList.AU | Select-Object -Unique
$adminUnits = @{}
Get-MgDirectoryAdministrativeUnit -Filter "DisplayName in ('$($auNames -join "','")')" | ForEach-Object {
    $adminUnits[$_.DisplayName] = $_.Id
}

foreach ($Group in $GroupList) {
    try {
        $Name = $Group.Name
        $NickName = $Group.NickName
        $AuName = $Group.AU

        # 创建可分配角色的组并提取ID
        $groupId = (New-MgGroup -DisplayName $Name -MailEnabled:$False -MailNickName $NickName -SecurityEnabled -IsAssignableToRole -Visibility "Private").Id
        
        # 检查管理单元是否存在
        if (-not $adminUnits.ContainsKey($AuName)) {
            throw "未找到指定管理单元: $AuName"
        }
        $adminUnitId = $adminUnits[$AuName]

        # 构造角色分配参数
        $params = @{
            "@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
            roleDefinitionId = "c4e39bd9-1100-46d3-8c65-fb160da0071f" # 身份验证管理员角色ID
            principalId = $groupId
            directoryScopeId = "/administrativeUnits/$adminUnitId"
        }

        # 创建角色分配
        New-MgRoleManagementDirectoryRoleAssignment -BodyParameter $params
        Write-Host "已成功为组 '$Name' 分配身份验证管理员角色（限定到管理单元 '$AuName'）"
    }
    catch {
        Write-Error "处理组 '$($Group.Name)' 时出错: $_"
    }
}

内容的提问来源于stack exchange，提问作者BPengu