Azure ARM模板自动化AD应用注册报错，求解决方案

错误“在DeploymentPropertiesContent对象上找不到成员'identity'”的核心原因是你错误地将identity字段放在了模板的properties节点下。ARM模板规则中，若要指定部署时使用的托管标识，需将identity配置放在模板顶层（与$schema、contentVersion同级）；如果是定义用户分配托管标识资源，identity则是该资源本身的属性，而非部署属性的子节点。

以下是修正后的ARM模板，包含用户分配托管标识创建、角色分配、Azure AD应用注册及客户端密钥生成的完整自动化流程：

1. 关键修正点 #

• 将部署用托管标识配置移至模板顶层，解决原位置错误导致的部署失败
• 新增角色分配资源，给托管标识分配Application Developer权限（用于创建AD应用）
• 使用最新稳定版API确保兼容性，定义AD应用及客户端密钥资源
• 添加输出节点，导出应用ID、客户端密钥等关键业务值

2. 完整修正后的ARM模板 #

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  // 部署时使用的托管标识（顶层配置，解决原错误）
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))]": {}
    }
  },
  "parameters": {
    "managedIdentityName": {
      "type": "string",
      "metadata": {
        "description": "用户分配托管标识的名称"
      }
    },
    "aadAppName": {
      "type": "string",
      "metadata": {
        "description": "Azure AD应用注册的名称"
      }
    },
    "clientKeyDescription": {
      "type": "string",
      "defaultValue": "Auto-generated client secret",
      "metadata": {
        "description": "客户端密钥的描述"
      }
    },
    "clientKeyExpiryDays": {
      "type": "int",
      "defaultValue": 365,
      "metadata": {
        "description": "客户端密钥的有效期天数"
      }
    }
  },
  "variables": {
    "applicationDeveloperRoleId": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", // Application Developer角色固定ID
    "tenantId": "[subscription().tenantId]"
  },
  "resources": [
    // 1. 创建用户分配托管标识
    {
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2023-01-31",
      "name": "[parameters('managedIdentityName')]",
      "location": "[resourceGroup().location]"
    },
    // 2. 为托管标识分配Application Developer角色（用于创建AD应用）
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(variables('tenantId'), parameters('managedIdentityName'), variables('applicationDeveloperRoleId'))]",
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('applicationDeveloperRoleId'))]",
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), '2023-01-31').principalId]",
        "principalType": "ServicePrincipal",
        "tenantId": "[variables('tenantId')]"
      }
    },
    // 3. 创建Azure AD应用注册
    {
      "type": "Microsoft.AAD/application",
      "apiVersion": "2023-04-01",
      "name": "[parameters('aadAppName')]",
      "dependsOn": [
        "[resourceId('Microsoft.Authorization/roleAssignments', guid(variables('tenantId'), parameters('managedIdentityName'), variables('applicationDeveloperRoleId')))]"
      ],
      "properties": {
        "displayName": "[parameters('aadAppName')]",
        "signInAudience": "AzureADMyOrg"
      }
    },
    // 4. 创建客户端密钥
    {
      "type": "Microsoft.AAD/applicationPasswords",
      "apiVersion": "2023-04-01",
      "name": "[concat(parameters('aadAppName'), '/', guid(parameters('aadAppName')))]",
      "dependsOn": [
        "[resourceId('Microsoft.AAD/application', parameters('aadAppName'))]"
      ],
      "properties": {
        "displayName": "[parameters('clientKeyDescription')]",
        "endDateTime": "[addDays(utcNow(), parameters('clientKeyExpiryDays'))]"
      }
    }
  ],
  "outputs": {
    "managedIdentityPrincipalId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), '2023-01-31').principalId]"
    },
    "aadAppClientId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.AAD/application', parameters('aadAppName')), '2023-04-01').appId]"
    },
    "clientSecretValue": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.AAD/applicationPasswords', concat(parameters('aadAppName'), '/', guid(parameters('aadAppName')))), '2023-04-01').secretText]"
    },
    "aadAppObjectId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.AAD/application', parameters('aadAppName')), '2023-04-01').id]"
    }
  }
}

3. 注意事项 #

• 部署模板的身份需具备创建用户分配托管标识、分配目录角色、创建AD应用的权限
• 客户端密钥的secretText仅在创建时返回，无法后续查询，需妥善保存输出值
• 若需调整AD应用的其他属性（如重定向URI、API权限），可在Microsoft.AAD/application的properties节点添加对应配置

内容的提问来源于stack exchange，提问作者DAK