关于Azure托管标识与应用注册访问控制的技术疑问

实验基础操作 #

• 创建Azure Data Factory资源（名称：otestadf）
• 创建应用注册（名称：testappreg），过程中生成applicationId与secret

疑问场景 #

在ADF资源的角色分配列表中未找到testappreg，但执行以下代码却能成功创建令牌及DataFactoryManagementClient实例：

var tenant = "tenant";
var clientId = "client";
var secret = "super_secret";

var client = ConfidentialClientApplicationBuilder
    .Create(clientId)
    .WithClientSecret(secret)
    .WithAuthority($"https://login.windows.net/{tenant}")
    .Build();

var x = client.AcquireTokenForClient(new []{ "https://graph.microsoft.com/.default" });
var accessToken = x.ExecuteAsync().Result.AccessToken; 

ServiceClientCredentials cred = new TokenCredentials(accessToken);
var dmclient = new DataFactoryManagementClient(cred) { SubscriptionId = "sub_id" };

我原以为因未给应用分配ADF访问角色，此操作会失败，这是否与使用https://graph.microsoft.com/.default作为Scope有关？

问题解决验证 #

将Scope设置为https://management.azure.com/.default后，成功实现ADF流水线运行功能，代码如下：

var cred = new ClientSecretCredential(tenant, clientId, secret);
var ctx = new TokenRequestContext(new string[] { "https://management.azure.com/.default" });
var token = await cred.GetTokenAsync(ctx);
var mgmtToken = new TokenCredentials(token.Token);
var client = new DataFactoryManagementClient(mgmtToken) { SubscriptionId = "SUB_ID" };
var response = await client.Pipelines.CreateRunWithHttpMessagesAsync(
    "test",
    "otestadf",
    "foobar");

内容的提问来源于stack exchange，提问作者Dr Schizo