通过PowerShell获取Azure AD应用API权限时返回空对象问题

我想要获取每个Azure AD应用注册所拥有的API权限及其他相关信息，但执行以下PowerShell脚本后，DelegatedPermissions和ApplicationPermissions字段返回空值。

原脚本 #

# Get all app registrations in the Azure Active Directory
$appRegistrations = Get-AzureADApplication

# Create an empty array to store app registration data
$appRegistrationData = @()

# Iterate over each app registration
foreach ($appRegistration in $appRegistrations) {
    # Retrieve application client ID
    $clientId = $appRegistration.AppId

    # Retrieve object ID
    $objectId = $appRegistration.ObjectId

    # Retrieve display name
    $displayName = $appRegistration.DisplayName

    # Retrieve API permissions (RequiredResourceAccess)
    $apiPermissions = $appRegistration.RequiredResourceAccess | ConvertTo-Json -Depth 5

    # Retrieve AppRoles, OAuth2Permissions, delegated permissions, and application permissions
    $servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$clientId'"

    $appRoles = $servicePrincipal.AppRoles | Select-Object -Property *
    $oauth2Permissions = $servicePrincipal.Oauth2Permissions | Select-Object -Property *
    $delegatedPermissions = $servicePrincipal.DelegatedPermissions | Select-Object -Property *
    $applicationPermissions = $servicePrincipal.AppRoles | Where-Object { $_.AllowedMemberTypes -contains "Application" }

    # Add the app registration data to the array
    $appRegistrationData += [PSCustomObject]@{
        DisplayName = $displayName
        ClientId = $clientId
        ObjectId = $objectId
        ApiPermissions = $apiPermissions
        AppRoles = $appRoles
        OAuth2Permissions = $oauth2Permissions
        DelegatedPermissions = $delegatedPermissions
        ApplicationPermissions = $applicationPermissions
    }
}

# Output the app registration data
$appRegistrationData | Format-Table -AutoSize

问题原因 #

1. $servicePrincipal.DelegatedPermissions属性不存在：AzureAD模块的ServicePrincipal对象没有这个属性，直接调用会返回空值。
2. 错误获取应用权限：脚本中试图从当前应用的AppRoles中筛选应用权限，这是错误的——自身的AppRoles是该应用暴露给其他应用的权限，而非该应用被授予的应用权限。

修正后的脚本 #

以下脚本会正确获取应用注册被授予的委托权限和应用权限：

# Get all app registrations in Azure AD
$appRegistrations = Get-AzureADApplication

# Initialize array to store results
$appRegistrationData = @()

foreach ($appRegistration in $appRegistrations) {
    $clientId = $appRegistration.AppId
    $objectId = $appRegistration.ObjectId
    $displayName = $appRegistration.DisplayName
    
    # Get the service principal of the current app
    $servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$clientId'"
    $spObjectId = $servicePrincipal.ObjectId

    # 1. 获取应用自身暴露的角色和OAuth2权限
    $appRoles = $servicePrincipal.AppRoles | Select-Object DisplayName, Value, Id, AllowedMemberTypes
    $oauth2Permissions = $servicePrincipal.Oauth2Permissions | Select-Object DisplayName, Value, Id, UserConsentDisplayName

    # 2. 获取该应用被授予的应用权限（Application Permissions）
    $applicationPermissions = Get-AzureADServiceAppRoleAssignment -ObjectId $spObjectId | ForEach-Object {
        # 获取权限所属的服务主体（即被访问的API）
        $resourceSp = Get-AzureADServicePrincipal -ObjectId $_.ResourceId
        # 匹配对应的AppRole
        $role = $resourceSp.AppRoles | Where-Object { $_.Id -eq $_.Id }
        [PSCustomObject]@{
            ApiDisplayName = $resourceSp.DisplayName
            PermissionName = $role.DisplayName
            PermissionValue = $role.Value
            PermissionType = "Application"
        }
    }

    # 3. 获取该应用被授予的委托权限（Delegated Permissions）
    $delegatedPermissions = Get-AzureADOAuth2PermissionGrant | Where-Object { $_.ClientId -eq $spObjectId } | ForEach-Object {
        $resourceSp = Get-AzureADServicePrincipal -ObjectId $_.ResourceId
        $scopeParts = $_.Scope -split " "
        foreach ($scope in $scopeParts) {
            $permission = $resourceSp.Oauth2Permissions | Where-Object { $_.Value -eq $scope }
            [PSCustomObject]@{
                ApiDisplayName = $resourceSp.DisplayName
                PermissionName = $permission.DisplayName
                PermissionValue = $permission.Value
                PermissionType = "Delegated"
            }
        }
    }

    # 4. 原始的RequiredResourceAccess（请求的权限）
    $apiPermissions = $appRegistration.RequiredResourceAccess | ConvertTo-Json -Depth 5

    # 添加到结果数组
    $appRegistrationData += [PSCustomObject]@{
        DisplayName = $displayName
        ClientId = $clientId
        ObjectId = $objectId
        ApiPermissionsRequested = $apiPermissions
        ExposedAppRoles = $appRoles
        ExposedOAuth2Permissions = $oauth2Permissions
        DelegatedPermissionsGranted = $delegatedPermissions
        ApplicationPermissionsGranted = $applicationPermissions
    }
}

# 输出结果（可以根据需要选择Format-Table或Export-Csv）
$appRegistrationData | Select-Object DisplayName, ClientId, DelegatedPermissionsGranted, ApplicationPermissionsGranted | Format-List

说明 #

• ExposedAppRoles/ExposedOAuth2Permissions：当前应用注册暴露给其他应用的角色和委托权限。
• DelegatedPermissionsGranted：当前应用被授予的、可代表用户访问其他API的委托权限。
• ApplicationPermissionsGranted：当前应用被授予的、以自身身份访问其他API的应用权限。
• ApiPermissionsRequested：应用注册中声明请求的权限（未批准的也会包含）。

内容的提问来源于stack exchange，提问作者Febian Shah