使用Microsoft.Graph PowerShell模块创建Azure AD应用时无法设置OAuth2权限范围

我尝试用New-MgApplication PowerShell Cmdlet创建Azure AD应用，同时设置OAuth2权限范围。Cmdlet运行正常，应用成功创建，但在Azure门户查看应用设置时，权限范围并未被设置。

我的代码如下：

[Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphWebApplication]$azureAdApiAppWebSettings = @{RedirectUris="http://localhost:4040"}

[Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.IMicrosoftGraphPermissionScope[]]$oauth2PermissionScopes = @(
    @{
        AdminConsentDescription="Access the application as admin.";
        AdminConsentDisplayName="Access as admin";
        Id=[guid]::NewGuid().ToString();
        IsEnabled=$true;
        Origin="Application";
        Type="User";
        UserConsentDescription="Access the application as user.";
        UserConsentDisplayName="Access as user";
        Value="access_as_user"
    }
)

[Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.IMicrosoftGraphApiApplication]$azureAdApiAppApiSettings = @{
    Oauth2PermissionScopes=$oauth2PermissionScopes;
}
$azureAdApiApp = New-MgApplication -DisplayName "MyApplicationName" -SignInAudience "AzureADMyOrg" -Web $azureAdApiAppWebSettings -Api $azureAdApiAppApiSettings

我想知道哪里操作有误？或者是否无法在创建应用时设置权限范围，只能在创建完成后使用Update-MgApplication进行设置？

问题原因 #

你代码中用哈希表直接构造IMicrosoftGraphPermissionScope数组的方式，可能导致PowerShell没有正确将哈希表转换为Graph API要求的强类型对象，最终权限范围参数没有被正确传递到创建请求中。

正确实现方式 #

创建应用时直接设置OAuth2权限范围是可行的，只需确保构造强类型的权限范围对象，而非仅用哈希表。修改代码如下：

# 构造Web应用设置
$azureAdApiAppWebSettings = @{
    RedirectUris = "http://localhost:4040"
}

# 创建强类型的OAuth2权限范围对象
$permissionScope = New-Object -TypeName Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphPermissionScope
$permissionScope.AdminConsentDescription = "Access the application as admin."
$permissionScope.AdminConsentDisplayName = "Access as admin"
$permissionScope.Id = [guid]::NewGuid().ToString()
$permissionScope.IsEnabled = $true
$permissionScope.Origin = "Application"
$permissionScope.Type = "User"
$permissionScope.UserConsentDescription = "Access the application as user."
$permissionScope.UserConsentDisplayName = "Access as user"
$permissionScope.Value = "access_as_user"

# 构造API应用设置，传入强类型权限范围对象
$azureAdApiAppApiSettings = @{
    Oauth2PermissionScopes = @($permissionScope)
}

# 创建Azure AD应用
$azureAdApiApp = New-MgApplication -DisplayName "MyApplicationName" `
    -SignInAudience "AzureADMyOrg" `
    -Web $azureAdApiAppWebSettings `
    -Api $azureAdApiAppApiSettings

备选方案：创建后更新权限范围 #

如果上述方式仍有问题，也可以先创建应用，再通过Update-MgApplication添加权限范围：

# 先创建应用
$azureAdApiApp = New-MgApplication -DisplayName "MyApplicationName" `
    -SignInAudience "AzureADMyOrg" `
    -Web $azureAdApiAppWebSettings

# 构造权限范围
$permissionScope = @{
    AdminConsentDescription="Access the application as admin.";
    AdminConsentDisplayName="Access as admin";
    Id=[guid]::NewGuid().ToString();
    IsEnabled=$true;
    Origin="Application";
    Type="User";
    UserConsentDescription="Access the application as user.";
    UserConsentDisplayName="Access as user";
    Value="access_as_user"
}

# 更新应用的权限范围
Update-MgApplication -ApplicationId $azureAdApiApp.Id `
    -Api @{ Oauth2PermissionScopes = @($permissionScope) }

内容的提问来源于stack exchange，提问作者Gaurav Mantri