如何在PowerShell中将Azure应用权限配置为Delegated（委托）

我有一个PowerShell脚本，用于在Azure中自动创建应用并分配特定权限。应用创建完成后，大多数权限被设置为'Application'类型，而我希望将它们设置为'Delegated'类型。

以下是原用于创建权限的PowerShell代码：

function Add-Permission {

    param(
        $App
    )

    $targetSpGraph = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"
    $appPermissionsRequired = @('User.Read.All','Group.Read.All','GroupMember.Read.All',`
    'GroupMember.ReadWrite.All','Directory.Read.All','AuditLog.Read.All')

    $RoleAssignmentsGraph = @()

    foreach ($AppPermission in $appPermissionsRequired) {
        $RoleAssignmentGraph = $targetSpGraph.AppRoles | Where-Object { $_.Value -eq $AppPermission }
        $RoleAssignmentsGraph += $RoleAssignmentGraph
    }

    $ResourceAccessObjectsGraph = New-Object 'System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]'

    foreach ($RoleAssignmentGraph in $RoleAssignmentsGraph) {
        $resourceAccessGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess"
        $resourceAccessGraph.Id = $RoleAssignmentGraph.Id
        $resourceAccessGraph.Type = 'Role'
        $ResourceAccessObjectsGraph.Add($resourceAccessGraph)
    }

    $requiredResourceAccessGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $requiredResourceAccessGraph.ResourceAppId = $targetSpGraph.AppId
    $requiredResourceAccessGraph.ResourceAccess = $ResourceAccessObjectsGraph

    $delPermissionGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "7427e0e9-2fba-42fe-b0c0-848c9e6a8182","Scope"
    $requiredResourceAccessGraph.ResourceAccess += $delPermissionGraph

    $targetSpAzure = Get-AzureADServicePrincipal -All $true | Where-Object { $_.DisplayName -eq "Windows Azure Service Management API" }
    $delPermissionAzure = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "41094075-9dad-400e-a0bd-54e686782033","Scope"

    $requiredResourceAccessAzure = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $requiredResourceAccessAzure.ResourceAppId = $targetSpAzure.AppId
    $requiredResourceAccessAzure.ResourceAccess = $delPermissionAzure

    Set-AzureADApplication -ObjectId $App.ObjectId -RequiredResourceAccess $requiredResourceAccessGraph, $requiredResourceAccessAzure

    Write-Output "Combined Permissions Added"

    return $App
}

修改方案 #

要将权限改为Delegated类型，核心需调整两个关键部分：

• 从服务主体中获取OAuth2权限（对应Delegated权限），而非AppRoles（对应Application权限）
• 将ResourceAccess对象的Type设置为Scope，而非Role

同时修正原代码中变量名重复的问题，避免逻辑错误。

修改后的完整代码：

function Add-Permission {

    param(
        $App
    )

    $targetSpGraph = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"
    $appPermissionsRequired = @('User.Read.All','Group.Read.All','GroupMember.Read.All',`
    'GroupMember.ReadWrite.All','Directory.Read.All','AuditLog.Read.All')

    $DelegatedAssignmentsGraph = @()

    foreach ($AppPermission in $appPermissionsRequired) {
        # 替换为获取OAuth2Permissions（Delegated权限）
        $DelegatedAssignmentGraph = $targetSpGraph.Oauth2Permissions | Where-Object { $_.Value -eq $AppPermission }
        $DelegatedAssignmentsGraph += $DelegatedAssignmentGraph
    }

    $ResourceAccessObjectsGraph = New-Object 'System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]'

    foreach ($DelegatedAssignmentGraph in $DelegatedAssignmentsGraph) {
        $resourceAccessGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess"
        $resourceAccessGraph.Id = $DelegatedAssignmentGraph.Id
        # 将Type改为Scope，对应Delegated权限
        $resourceAccessGraph.Type = 'Scope'
        $ResourceAccessObjectsGraph.Add($resourceAccessGraph)
    }

    $requiredResourceAccessGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $requiredResourceAccessGraph.ResourceAppId = $targetSpGraph.AppId
    $requiredResourceAccessGraph.ResourceAccess = $ResourceAccessObjectsGraph

    # 保留原有已正确设置的Delegated权限添加逻辑
    $delPermissionGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "7427e0e9-2fba-42fe-b0c0-848c9e6a8182","Scope"
    $requiredResourceAccessGraph.ResourceAccess += $delPermissionGraph

    $targetSpAzure = Get-AzureADServicePrincipal -All $true | Where-Object { $_.DisplayName -eq "Windows Azure Service Management API" }
    $delPermissionAzure = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "41094075-9dad-400e-a0bd-54e686782033","Scope"

    $requiredResourceAccessAzure = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $requiredResourceAccessAzure.ResourceAppId = $targetSpAzure.AppId
    $requiredResourceAccessAzure.ResourceAccess = $delPermissionAzure

    Set-AzureADApplication -ObjectId $App.ObjectId -RequiredResourceAccess $requiredResourceAccessGraph, $requiredResourceAccessAzure

    Write-Output "Combined Permissions Added"

    return $App
}

关键修改点说明 #

1. 权限来源替换：将$targetSpGraph.AppRoles改为$targetSpGraph.Oauth2Permissions，Oauth2Permissions存储的是Delegated类型的权限定义，AppRoles对应Application类型权限。
2. Type字段修改：将$resourceAccessGraph.Type = 'Role'改为'Scope'，Azure AD通过该字段区分权限类型：Role对应Application权限，Scope对应Delegated权限。
3. 变量名修正：将原RoleAssignmentsGraph等变量名改为DelegatedAssignmentsGraph，避免循环内变量名冲突导致的逻辑错误。

内容的提问来源于stack exchange，提问作者Harry