如何扩展脚本获取Azure企业应用的唯一声明ID及关联信息？

一、问题分析 #

你之前获取SAML声明的脚本失败，是因为对Saml2Settings的结构理解有误——企业应用的SAML配置实际存储在ServicePrincipal的关联属性和对应的Application对象的SamlSingleSignOnSettings中，唯一声明ID对应ClaimType的Id字段。下面是整合所有需求的完整脚本。

二、完整扩展脚本 #

# 获取所有启用状态的企业应用服务主体
$enabledApps = Get-AzureADServicePrincipal -All $true | Where-Object { $_.AccountEnabled -eq $true }

$appData = @()

foreach ($app in $enabledApps) {
    # 1. 获取SAML声明（含唯一声明ID）
    $samlSettings = Get-AzureADApplication -Filter "AppId eq '$($app.AppId)'" | Select-Object -ExpandProperty SamlSingleSignOnSettings -ErrorAction SilentlyContinue
    $samlClaims = @()
    if ($samlSettings) {
        foreach ($mapping in $samlSettings.AttributeMappings) {
            $samlClaims += [PSCustomObject]@{
                DisplayName = $mapping.Name
                SourceAttribute = $mapping.SourceAttribute
                UniqueClaimId = $mapping.ClaimType.Id
            }
        }
    }

    # 2. 获取自定义声明映射策略（若存在）
    $claimPolicies = @()
    if ($app.ClaimsMappingPolicy -ne $null) {
        foreach ($policyId in $app.ClaimsMappingPolicy) {
            $policy = Get-AzureADPolicy -Id $policyId
            $policyClaims = ($policy.Definition | ConvertFrom-Json).ClaimsSchema
            $claimPolicies += $policyClaims | Select-Object Id, Name, Description
        }
    }

    # 3. 获取已分配的用户和组
    $assignments = Get-AzureADServicePrincipalAppRoleAssignment -ObjectId $app.ObjectId -All $true
    $assignedUsers = $assignments | Where-Object { $_.PrincipalType -eq "User" }
    $assignedGroups = $assignments | Where-Object { $_.PrincipalType -eq "Group" }

    # 4. 获取应用所有者
    $owners = Get-AzureADServicePrincipalOwner -ObjectId $app.ObjectId -All $true

    # 整合所有数据为可导出格式
    $appInfo = [PSCustomObject]@{
        DisplayName = $app.DisplayName
        ObjectId = $app.ObjectId
        AppId = $app.AppId
        ServicePrincipalType = $app.ServicePrincipalType
        PublisherName = $app.PublisherName
        Tags = $app.Tags -join "; "
        # 格式化分配对象，避免CSV导出时显示对象类型
        AssignedUsers = ($assignedUsers | ForEach-Object { "$($_.PrincipalDisplayName) ($($_.PrincipalId))" }) -join "; "
        AssignedGroups = ($assignedGroups | ForEach-Object { "$($_.PrincipalDisplayName) ($($_.PrincipalId))" }) -join "; "
        Owners = ($owners | ForEach-Object { "$($_.DisplayName) ($($_.UserPrincipalName))" }) -join "; "
        # 格式化声明信息，包含唯一ID
        SAMLAttributeClaims = ($samlClaims | ForEach-Object { "$($_.DisplayName): $($_.SourceAttribute) (ID: $($_.UniqueClaimId))" }) -join "; "
        ClaimsMappingPolicies = ($claimPolicies | ForEach-Object { "$($_.Name) (ID: $($_.Id))" }) -join "; "
    }

    $appData += $appInfo
}

# 导出到CSV文件
$appData | Export-Csv -Path "C:\Temp\AzureEnterpriseApps_Detailed.csv" -NoTypeInformation -Encoding UTF8

三、关键说明 #

• 唯一声明ID：通过SamlSingleSignOnSettings.AttributeMappings.ClaimType.Id获取，这是Azure AD中声明的全局唯一标识符。
• 权限要求：执行脚本需要Directory.Read.All或Application.Read.All权限，请确保登录的Azure AD账号拥有对应权限。
• 空值处理：部分应用可能未配置SAML或自定义声明策略，对应字段会显示为空，属于正常情况。
• CSV兼容性：所有集合类型数据均转为分号分隔的字符串，避免导出CSV时出现对象序列化异常。

内容的提问来源于stack exchange，提问作者JeffD