Azure B2C聚合应用PowerShell创建密钥失败，如何解决？

问题场景 #

尝试通过PowerShell为Azure B2C租户中「任何标识提供者或组织目录中的账户（通过用户流验证用户）」类型的应用创建密钥时，使用针对普通应用有效的New-AzureADApplicationPasswordCredential命令执行失败，报错信息如下：

New-AzureADApplicationPasswordCredential : Error occurred while executing SetApplication
Code: Request_BadRequest
Message: Updates to converged applications are not allowed in this version.
RequestId: 9630857f-6d32-4788-8637-0a15967beb22
DateTimeStamp: Wed, 05 Apr 2023 13:22:19 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:3 char:1
+ New-AzureADApplicationPasswordCredential -CustomKeyIdentifier b2csecr ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-AzureADApplicationPasswordCredential], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD.Graph.PowerShell.Custom.NewAzureADA
pplicationPasswordCredential

报错说明 #

该报错并非意味着无法操作，而是旧版AzureAD模块基于Azure AD Graph API，不支持修改联合类型（Converged）的应用。需要改用基于Microsoft Graph API的Microsoft.Graph PowerShell模块来实现。

解决方案步骤 #

1. 安装并导入Microsoft Graph模块 #

Install-Module Microsoft.Graph -Force
Import-Module Microsoft.Graph.Applications

2. 连接到Microsoft Graph #

需要获取Application.ReadWrite.All权限来管理应用：

# 针对B2C租户，建议指定租户ID确保连接准确
Connect-MgGraph -TenantId "你的B2C租户ID（如xxx.onmicrosoft.com）" -Scopes "Application.ReadWrite.All"

3. 创建应用密钥 #

替换命令中的ApplicationId为目标应用的对象ID，自定义密钥显示名称和有效期：

$startDate = Get-Date
$endDate = $startDate.AddYears(5)

$params = @{
    PasswordCredential = @{
        DisplayName = "b2csecret"
        StartDateTime = $startDate
        EndDateTime = $endDate
    }
}

New-MgApplicationPassword -ApplicationId "6133a24a-2cc7-4b47-901c-2e2c67b0bed6" -BodyParameter $params

执行成功后，返回结果中的SecretText字段即为生成的应用密钥，请务必立即保存，因为后续无法再次查看该密钥内容。

内容的提问来源于stack exchange，提问作者Waltz