如何通过Python SDK获取Azure AVD应用组的用户分配？

方法1：调用Azure REST API直接查询 #

Azure提供了专门的REST API接口用于获取应用组的用户分配信息，你可以用Python的requests库结合Azure AD身份验证实现调用。

实现步骤与代码示例 #

import requests
from azure.identity import DefaultAzureCredential

# 替换为你的资源参数
subscription_id = "你的订阅ID"
resource_group = "目标资源组名称"
app_group_name = "目标应用组名称"
api_version = "2023-09-05"

# 获取Azure AD访问令牌
credential = DefaultAzureCredential()
token = credential.get_token("https://management.azure.com/.default").token

# 构建请求URL并发送请求
request_url = f"https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.DesktopVirtualization/applicationGroups/{app_group_name}/userAssignments?api-version={api_version}"
headers = {"Authorization": f"Bearer {token}"}
response = requests.get(request_url, headers=headers)
response.raise_for_status()

# 解析并输出用户分配结果
user_assignments = response.json()
for item in user_assignments.get("value", []):
    print(f"分配用户ID: {item['properties']['userId']}")
# 如需用户名称、邮箱等详情，可结合Microsoft Graph API用用户ID查询

方法2：通过Azure RBAC角色分配查询 #

用户能访问AVD应用组，通常是被分配了Desktop Virtualization User角色，你可以用azure-mgmt-authorization库查询该应用组范围内的对应角色分配，从而提取用户列表。

实现步骤与代码示例 #

1. 先依赖库：

pip install azure-mgmt-authorization azure-mgmt-desktopvirtualization

2. 代码实现：

from azure.identity import DefaultAzureCredential
from azure.mgmt.authorization import AuthorizationManagementClient
from azure.mgmt.desktopvirtualization import DesktopVirtualizationMgmtClient

# 替换为你的资源参数
subscription_id = "你的订阅ID"
resource_group = "目标资源组名称"
app_group_name = "目标应用组名称"

# 初始化客户端
credential = DefaultAzureCredential()
desktop_client = DesktopVirtualizationMgmtClient(credential, subscription_id)
auth_client = AuthorizationManagementClient(credential, subscription_id)

# 获取应用组的资源ID
app_group = desktop_client.application_groups.get(resource_group, app_group_name)
app_group_resource_id = app_group.id

# 查询Desktop Virtualization User角色的分配（该角色固定ID为b15384b6-2828-48ab-97dc-7e1418d1f5f2）
target_role_id = f"/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/b15384b6-2828-48ab-97dc-7e1418d1f5f2"
role_assignments = auth_client.role_assignments.list_for_scope(
    scope=app_group_resource_id,
    filter=f"roleDefinitionId eq '{target_role_id}'"
)

# 输出用户信息
for assignment in role_assignments:
    print(f"用户主体ID: {assignment.principal_id}")
# 如需用户详情，可结合Microsoft Graph API查询

补充说明 #

• 两种方法都需要调用者拥有Desktop Virtualization Reader或更高权限的Azure角色
• 若需获取用户的名称、邮箱等更详细信息，可通过Microsoft Graph API，用用户主体ID或用户ID查询对应资料

内容的提问来源于stack exchange，提问作者Jorge