为Microsoft.DocumentDB分配AAD组sqlRoleAssignments权限遇403问题[已解决]

我尝试使用sqlRoleAssignments为AAD用户组授予Cosmos DB权限，已成功搭建Azure Function通过sqlRoleAssignment连接Cosmos DB的POC。但将自己所属的用户组分配到同一个sqlRoleAssignment后，本地运行函数时收到如下权限不足的错误：

[2023-04-29T06:02:51.177Z] System.Private.CoreLib: Exception while executing function: readdatabases. Microsoft.Azure.Cosmos.Client: Response status code does not indicate success: Forbidden (403); Substatus: 5301; ActivityId: 459dd11a-2dd1-4730-9487-adb7ccebf166; Reason: (Request blocked by Auth cosmos-account-masterclass-4661b132 : Request is blocked because principal [principalId of user in the group] does not have required RBAC permissions to perform action [Microsoft.DocumentDB/databaseAccounts/readMetadata] on resource [/]. Learn more: https://aka.ms/cosmos-native-rbac.

该权限分配通过Bicep完成，代码与为Function系统托管标识分配权限的逻辑几乎一致：

var developersGroupObjectId = '*object id of the developers group*'
var roleAssignmentDevelopersId = guid(roleDefinitionId, developersGroupObjectId, cosmosAccount.id)
resource sqlRoleAssignmentDevelopersGroup 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2021-04-15' = {
  parent: cosmosAccount
  name: roleAssignmentDevelopersId
  properties: {
    roleDefinitionId: sqlRoleDefinition.id
    principalId: developersGroupObjectId
    scope: cosmosAccount.id
  }
}

原疑问 #

角色分配是否不会从用户所属组继承？若情况属实，有哪些替代方法可通过AAD组管理用户访问权限？

排查更新 #

经确认，角色分配完全支持从用户组继承，可以正常通过AAD组为用户授予Cosmos DB权限。本次403错误的根源在于：将自己加入用户组后，需要重新获取访问令牌。

相关规则说明：

由于标识的组和角色是访问令牌中的声明，任何授权更改需等到令牌刷新后才会生效。对于人类用户，通常只需重新登录（或等待令牌默认1小时的生命周期过期）即可获取新令牌。

内容的提问来源于stack exchange，提问作者Tom Bosmans