使用Microsoft Graph Cmdlets配置条件访问策略报错求助

我在通过Microsoft Graph PowerShell Cmdlets设置条件访问策略时遇到错误，相关脚本如下：

$params = @{
    displayName = "Block Legacy authentication"
    state = "disabled"
    conditions = @{
       applications = @{
            includeApplication = @(
                "All"
        )
    }
    users = @{
        includeUsers = @(
            "All"
        )
        excludeGroups = @(
            $ExcludeCAGroup.Id
        )
    }
    clientAppTypes = @(
        'exchangeActiveSync', 'other'
    )
}
grantControls = @{
    operator = "OR"
    builtInControls = @(
    "block"
    )
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

执行该脚本时抛出以下错误：

New-MgIdentityConditionalAccessPolicy : 1007: Incoming ConditionalAccessPolicy object is null or does not match the schema of ConditionalAccessPolicy type. For examples, please see API documentation at 
https://docs.microsoft.com/en-us/graph/api/conditionalaccessroot-post-policies?view=graph-rest-1.0.
Status: 400 (BadRequest)
ErrorCode: BadRequest
Date: 2023-10-27T12:12:30
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 956cdf72-b772-4537-8a20-caff949ef3c1
ErrorId : BadRequest,Microsoft.Graph.PowerShell.Cmdlets.NewMgIdentityConditionalAccessPolicy_Create

问题分析与修复方案 #

你的脚本存在两个关键问题，导致不符合ConditionalAccessPolicy的schema要求：

• 哈希表结构错误：grantControls被错误地放在了$params哈希表的闭合括号之外，导致整个$params结构不完整，PowerShell无法正确解析为符合要求的对象。
• 属性名称拼写错误：applications下的属性应该是includeApplications（复数形式），而不是includeApplication，这与Graph API的schema定义不匹配。

修正后的脚本 #

# 确保$ExcludeCAGroup已通过Get-MgGroup等命令正确获取
$params = @{
    displayName = "Block Legacy authentication"
    state = "disabled"
    conditions = @{
        applications = @{
            includeApplications = @(
                "All"
            )
        }
        users = @{
            includeUsers = @(
                "All"
            )
            excludeGroups = @(
                $ExcludeCAGroup.Id
            )
        }
        clientAppTypes = @(
            'exchangeActiveSync', 'other'
        )
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @(
            "block"
        )
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

修正说明 #

1. 将grantControls移至$params哈希表内部，作为顶级键，确保整个对象结构完整且符合schema要求。
2. 将includeApplication修改为includeApplications，匹配Graph API对条件访问策略中应用包含规则的属性命名规范。

内容的提问来源于stack exchange，提问作者aarbuzik