使用Microsoft Graph创建Service Principal时遭遇400错误求助

场景概述 #

使用Azure DevOps发布流程（共4个阶段），完成AD App创建后，在最后创建Service Principal的阶段触发400错误。

错误日志 #

2023-09-05T13:39:41.0436428Z Invoke-RestMethod : The remote server returned an error: (400) Bad Request.
2023-09-05T13:39:41.0437341Z At D:\a_temp\7c35c69d-f2e4-4452-b160-6c78f192c351.ps1:27 char:13
2023-09-05T13:39:41.0437693Z + $response = Invoke-RestMethod -Uri "``https://graph.microsoft.com/v1.0/`` ...
2023-09-05T13:39:41.0437902Z +             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-09-05T13:39:41.0442426Z     + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc
2023-09-05T13:39:41.0443046Z    eption
2023-09-05T13:39:41.0443862Z     + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand
2023-09-05T13:39:41.0444318Z
2023-09-05T13:39:41.0992052Z ##[debug]Exit code: 1
2023-09-05T13:39:41.1032324Z ##[debug]Leaving Invoke-VstsTool.
2023-09-05T13:39:41.1798598Z ##[error]PowerShell exited with code '1'.
2023-09-05T13:39:41.1807603Z ##[debug]Processed: ##vso[task.logissue type=error]PowerShell exited with code '1'.
2023-09-05T13:39:41.1896872Z ##[debug]Processed: ##vso[task.complete result=Failed]Error detected
2023-09-05T13:39:41.1912577Z ##[debug]Leaving D:\a_tasks\PowerShell_e213ff0f-5d5c-4791-802d-52ea3e7be1f1\2.226.2\powershell.ps1.
2023-09-05T13:39:41.2221878Z ##[section]Finishing: Create Service Principal

使用的PowerShell脚本 #

Start-Sleep -Seconds 30

# Variables
$accessToken = "$env:AccessToken"

$rAppId = Get-Content -Path "rAppObjId.txt"

# Show AppID
Write-Host "Using AppId: $rAppId"

# Request Headers
$headers = @{
    "Authorization" = "Bearer $accessToken"
    "Content-Type" = "application/json"
    "Accept" = "text/html, application/json"
}

# Create Service Principal
$body = @{
    AppId = $rAppId
    tags = @("WindowsAzureActiveDirectoryIntegratedApp")
}

$response = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals" -Method Post -Headers $headers -Body ($body | ConvertTo-Json -Depth 4)

排查方向与解决建议 #

1. 验证rAppId的正确性 #

• 脚本中rAppId必须是AD App的Application (client) ID，而非App的Object ID。如果rAppObjId.txt中存储的是Object ID，会直接导致400错误。
• 验证方式：登录Azure门户，找到创建的AD App，确认其Application ID与文件中的值完全一致。

2. 检查Graph API权限 #

• 创建Service Principal需要Application.ReadWrite.All或Directory.ReadWrite.All的应用权限（而非委派权限），且已完成管理员同意。
• 确认Azure DevOps流程使用的服务主体已被授予上述权限，且权限状态为“已同意”。

3. 优化请求头格式 #

• Accept头建议只保留application/json，避免混合格式导致服务端解析异常：

  $headers = @{
      "Authorization" = "Bearer $accessToken"
      "Content-Type" = "application/json"
      "Accept" = "application/json"
  }
  

4. 替换固定延迟为状态验证 #

• 目前用Start-Sleep -Seconds 30等待App创建完成，建议改为轮询检查App是否存在，确认创建完成后再执行Service Principal创建：

  $maxRetries = 10
  $retryCount = 0
  $appExists = $false
  
  while ($retryCount -lt $maxRetries -and -not $appExists) {
      try {
          $checkApp = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/applications(appId='$rAppId')" -Method Get -Headers $headers
          $appExists = $true
          Write-Host "App found successfully"
      } catch {
          $retryCount++
          Write-Host "App not found, retrying in 10 seconds (Retry $retryCount/$maxRetries)"
          Start-Sleep -Seconds 10
      }
  }
  
  if (-not $appExists) {
      Write-Error "App with ID $rAppId not found after $maxRetries retries"
      exit 1
  }
  

5. 捕获详细错误响应 #

• 修改Invoke-RestMethod调用，捕获完整的错误响应内容，便于定位具体问题：

  try {
      $response = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals" -Method Post -Headers $headers -Body ($body | ConvertTo-Json -Depth 4)
  } catch {
      $errorStream = $_.Exception.Response.GetResponseStream()
      $reader = New-Object System.IO.StreamReader($errorStream)
      $reader.BaseStream.Position = 0
      $reader.DiscardBufferedData()
      $errorBody = $reader.ReadToEnd()
      Write-Host "Detailed Error: $errorBody"
      throw
  }
  

内容的提问来源于stack exchange，提问作者Eduard S.