Azure Function执行PowerShell脚本报错：未指定默认订阅

脚本与依赖配置 #

PowerShell触发脚本 #

using namespace System.Net

# Input bindings are passed in via param block.
param($Request, $TriggerMetadata)

# Write to the Azure Functions log stream.
Write-Host "PowerShell HTTP trigger function processed a request."

$WorkspaceName = $Request.Query.WorkspaceName
if (-not $WorkspaceName) {
$WorkspaceName = $Request.Body.WorkspaceName
}

$PipelineName = $Request.Query.PipelineName
if (-not $PipelineName) {
$PipelineName = $Request.Body.PipelineName
}  

$body = "This HTTP triggered function executed successfully. Pass a name in the query string or in the request body for a personalized response."

if ($WorkspaceName && $PipelineName) {
$body = "Hello Gabriel, This HTTP triggered function executed successfully."
}

Invoke-AzSynapsePipeline -WorkspaceName $WorkspaceName -PipelineName $PipelineName

Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
StatusCode = [HttpStatusCode]::OK
Body = $body
})

requirements.psd1依赖文件 #

@{
    'Az.Synapse' = '0.10.0'
    'Az.Accounts' = '2.2.3'
}

错误信息 #

[Error] ERROR: No default subscription has been designated. Use Select-AzSubscription -Default <subscriptionName> to set the default subscription.

解决步骤 #

1. 启用Azure Function的系统托管标识 #

• 登录Azure门户，打开目标Function App资源
• 切换到身份选项卡，在系统分配标签下将状态设为开启，点击保存

2. 为托管标识分配Synapse工作区权限 #

• 打开目标Synapse工作区资源
• 切换到访问控制(IAM)选项卡，点击添加 > 添加角色分配
• 在角色列表中选择合适权限（推荐Synapse Pipeline Operator或Synapse Contributor，遵循最小权限原则）
• 在成员页面选择托管标识 > 选择成员，找到对应的Function App系统标识，完成添加后保存角色分配

3. 修改PowerShell脚本添加认证逻辑 #

在调用Invoke-AzSynapsePipeline之前，添加托管标识认证和订阅指定代码：

# 使用系统托管标识完成Azure认证
Connect-AzAccount -Identity

# 指定要操作的订阅ID（替换为你的实际订阅ID）
Select-AzSubscription -SubscriptionId "your-subscription-id-here"

修改后的完整脚本：

using namespace System.Net

# Input bindings are passed in via param block.
param($Request, $TriggerMetadata)

# Write to the Azure Functions log stream.
Write-Host "PowerShell HTTP trigger function processed a request."

$WorkspaceName = $Request.Query.WorkspaceName
if (-not $WorkspaceName) {
$WorkspaceName = $Request.Body.WorkspaceName
}

$PipelineName = $Request.Query.PipelineName
if (-not $PipelineName) {
$PipelineName = $Request.Body.PipelineName
}  

$body = "This HTTP triggered function executed successfully. Pass a name in the query string or in the request body for a personalized response."

if ($WorkspaceName && $PipelineName) {
$body = "Hello Gabriel, This HTTP triggered function executed successfully."
}

# 使用系统托管标识完成Azure认证
Connect-AzAccount -Identity

# 指定要操作的订阅ID（替换为你的实际订阅ID）
Select-AzSubscription -SubscriptionId "your-subscription-id-here"

Invoke-AzSynapsePipeline -WorkspaceName $WorkspaceName -PipelineName $PipelineName

Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
StatusCode = [HttpStatusCode]::OK
Body = $body
})

说明 #

• 系统托管标识是Azure提供的免密钥认证方式，无需在代码中存储任何凭证，安全性更高
• 必须为标识分配足够权限才能触发Synapse管道，优先选择最小权限角色
• 若标识仅有权限访问单个订阅，Select-AzSubscription步骤可省略，但显式指定能避免歧义

内容的提问来源于stack exchange，提问作者Gabriel Padilha