PowerShell生成Azure AD北美用户报告：无法获取SAM Account Name

我用以下PowerShell脚本从Azure AD导出北美地区（美国、加拿大）已启用用户的部分属性到CSV，脚本运行正常，但尝试添加SAM Account Name列时，用$azuser.SamAccountName、$azuser.ExtentionProperty["SamAccountName"]、$azuser.ObjectID["SamAccountName"]都无法获取到该属性，求解决办法。

原脚本：

param(
    [string] $path = "C:\Temp\ADUsersNA-$(Get-Date -format 'MM-dd-yyyy').csv"
)
 
Connect-AzureAD

$userData = @()

foreach ($azuser in Get-AzureADUser -All $true -Filter "accountEnabled eq true" | Where-Object { $_.Country -eq "United States" -or $_.Country -eq "Canada" }) {
    $manager = Get-AzureADUserManager -ObjectId $azuser.ObjectId -ErrorAction SilentlyContinue
    $managerEmail = if ($manager) { $manager.UserPrincipalName } else { "" }

    $userData += [pscustomobject]@{
        "Employee ID"   = $azuser.ExtensionProperty["employeeId"]
        "First Name"    = $azuser.givenName
        "Last Name"     = $azuser.surname
        "Work Email"    = $azuser.UserPrincipalName
        "Job Title"     = $azuser.JobTitle
        "Company"       = $azuser.CompanyName
        "Manager Email" = $managerEmail
        "City"          = $azuser.City
        "Country"       = $azuser.Country
    }
}

$userData | Export-Csv -Path $path -NoTypeInformation

尝试过的代码片段：

"SAM Name"     = $azuser.SamAccountName
"SAM Name"     = $azuser.ExtentionProperty["SamAccountName"]
"SAM Name"     = $azuser.ObjectID["SamAccountName"]

解决办法 #

1. 属性名称修正：Azure AD中SAM Account Name对应的标准属性是onPremisesSamAccountName，而非你尝试的名称。
2. 显式指定属性：Get-AzureADUser默认只返回基础属性集合，需要通过-Properties参数显式声明要获取onPremisesSamAccountName。

修改后的完整脚本 #

param(
    [string] $path = "C:\Temp\ADUsersNA-$(Get-Date -format 'MM-dd-yyyy').csv"
)
 
Connect-AzureAD

$userData = @()

# 新增-Properties参数指定获取onPremisesSamAccountName属性
foreach ($azuser in Get-AzureADUser -All $true -Filter "accountEnabled eq true" -Properties onPremisesSamAccountName | Where-Object { $_.Country -eq "United States" -or $_.Country -eq "Canada" }) {
    $manager = Get-AzureADUserManager -ObjectId $azuser.ObjectId -ErrorAction SilentlyContinue
    $managerEmail = if ($manager) { $manager.UserPrincipalName } else { "" }

    $userData += [pscustomobject]@{
        "Employee ID"       = $azuser.ExtensionProperty["employeeId"]
        "First Name"        = $azuser.givenName
        "Last Name"         = $azuser.surname
        "Work Email"        = $azuser.UserPrincipalName
        "Job Title"         = $azuser.JobTitle
        "Company"           = $azuser.CompanyName
        "Manager Email"     = $managerEmail
        "City"              = $azuser.City
        "Country"           = $azuser.Country
        "SAM Account Name"  = $azuser.onPremisesSamAccountName # 新增SAM账号列
    }
}

$userData | Export-Csv -Path $path -NoTypeInformation

内容的提问来源于stack exchange，提问作者Pmocha