如何通过Azure Python SDK添加Azure Digital Twins数据所有者角色

已完成的操作 #

已通过Azure Python SDK成功创建资源组及Azure Digital Twins实例，代码如下：

from azure.identity import AzureCliCredential, DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.digitaltwins import AzureDigitalTwinsManagementClient

credential = DefaultAzureCredential()
subscription_id="some UUID" # 已隐藏实际值

resource_client = ResourceManagementClient(
    credential, subscription_id=subscription_id)

resource_group_name = "Tutorial-RG"
rg_result = resource_client.resource_groups.create_or_update(
    resource_group_name, {"location": "westeurope"}
)

client = AzureDigitalTwinsManagementClient(
    credential=DefaultAzureCredential(),
    subscription_id=subscription_id,
)

dt_resource_name = "myDigitalTwinsService"
response = client.digital_twins.begin_create_or_update(
    resource_group_name=rg_result.name,
    resource_name = dt_resource_name,
    digital_twins_create={"location": "westeurope"},
).result()
print(response)

# ...
# 'provisioning_state': 'Succeeded',
# ...

CLI方式可成功分配角色 #

使用Azure CLI可以完成"Azure Digital Twins Data Owner"角色分配：

az dt role-assignment create --dt-name myDigitalTwinsService --assignee "my UUID" --role "Azure Digital Twins Data Owner" --debug

Python SDK尝试角色分配遇到的问题 #

尝试使用Azure Authorization Management Client分配角色，代码如下：

from azure.mgmt.authorization.models import RoleAssignmentCreateParameters
from azure.mgmt.authorization import AuthorizationManagementClient

authorization_client = AuthorizationManagementClient(
    credential=DefaultAzureCredential(),
    subscription_id=subscription_id,
)

adt_data_owner_role_id ='bcd981a7-7f74-457b-83e1-cceb9e632ffe'
role_def_id = f'/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/{adt_data_owner_role_id}'
authorization_client.role_assignments.create(
    scope=SCOPE,
    role_assignment_name=f"/subscriptions/{subscription_id}/resourceGroups/Tutorial-RG/providers/Microsoft.DigitalTwins/digitalTwinsInstances/myDigitalTwinsService/providers/Microsoft.Authorization/roleAssignments/60252f13-5e5a-4686-8265-3ac2db6443f1",
    parameters=RoleAssignmentCreateParameters(
        role_definition_id= role_def_id,
        principal_id= 'my UUID',
        principal_type="User",
    )
)

错误1：资源提供商未找到 #

HttpResponseError: (NoRegisteredProviderFound) No registered resource provider found for location 'westeurope' and API version '2022-04-01' for type 'digitalTwinsInstances'. The supported api-versions are '2023-01-31, 2022-10-31, 2022-05-31, 2021-06-30-preview, 2020-12-01, 2020-10-31, 2020-03-01-preview'. The supported locations are 'westcentralus, westus2, northeurope, australiaeast, westeurope, eastus, southcentralus, southeastasia, uksouth, eastus2, westus3, japaneast, koreacentral, qatarcentral'.
Code: NoRegisteredProviderFound
Message: No registered resource provider found for location 'westeurope' and API version '2022-04-01' for type 'digitalTwinsInstances'. The supported api-versions are '2023-01-31, 2022-10-31, 2022-05-31, 2021-06-30-preview, 2020-12-01, 2020-10-31, 2020-03-01-preview'. The supported locations are 'westcentralus, westus2, northeurope, australiaeast, westeurope, eastus, southcentralus, southeastasia, uksouth, eastus2, westus3, japaneast, koreacentral, qatarcentral'.

错误2：修改API版本后报错 #

authorization_client = AuthorizationManagementClient(
    credential=DefaultAzureCredential(),
    subscription_id=subscription_id,
    api_version = '2022-05-31'
)
# 其余代码不变

# ValueError: API version 2022-05-31 does not have operation group 'role_assignments'

使用的Azure SDK版本 #

azure-common==1.1.28
azure-core==1.26.2
azure-digitaltwins-core==1.2.0
azure-identity==1.12.0
azure-mgmt-authorization==3.0.0
azure-mgmt-core==1.3.2
azure-mgmt-digitaltwins==6.4.0
azure-mgmt-resource==22.0.0

问题根源在于Scope参数定义错误和角色分配名称格式错误，修正后即可正常完成角色分配：

修正后的代码 #

import uuid
from azure.identity import DefaultAzureCredential
from azure.mgmt.authorization import AuthorizationManagementClient
from azure.mgmt.authorization.models import RoleAssignmentCreateParameters

credential = DefaultAzureCredential()
subscription_id = "你的订阅UUID"
resource_group_name = "Tutorial-RG"
dt_resource_name = "myDigitalTwinsService"

# 定义ADT实例的完整资源范围（核心修正点）
adt_scope = f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.DigitalTwins/digitalTwinsInstances/{dt_resource_name}"

# 初始化Authorization客户端（使用SDK默认API版本即可，3.0.0对应2022-04-01）
authorization_client = AuthorizationManagementClient(
    credential=credential,
    subscription_id=subscription_id
)

# Azure Digital Twins Data Owner的固定角色ID
adt_data_owner_role_id = "bcd981a7-7f74-457b-83e1-cceb9e632ffe"
role_def_id = f"/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/{adt_data_owner_role_id}"

# 生成随机UUID作为角色分配名称（无需手动拼接完整路径）
role_assignment_name = str(uuid.uuid4())

# 创建角色分配
response = authorization_client.role_assignments.create(
    scope=adt_scope,
    role_assignment_name=role_assignment_name,
    parameters=RoleAssignmentCreateParameters(
        role_definition_id=role_def_id,
        principal_id="你的用户/服务主体UUID",
        principal_type="User"  # 服务主体请改为"ServicePrincipal"
    )
)

print(f"角色分配成功：{response}")

额外注意事项 #

1. 确保执行代码的身份拥有Microsoft.Authorization/roleAssignments/write权限（如订阅级别的所有者、用户访问管理员角色）。
2. 如果仍遇到资源提供商未注册错误，先运行以下命令注册提供商：

az provider register --namespace Microsoft.DigitalTwins

内容的提问来源于stack exchange，提问作者cozek