将 Azure Active Directory 权限分配给启用 MSI 的 Azure 功能的权限不足？

Question

我们在同一个目录中有两个 azure 资源。 Azure API 管理和 Azure 函数背后的一组 webAPI API。我们希望 azure 函数能够调用 API。如How to use managed identities for App Service and Azure Functions 中所述，我们已在 azure 功能上启用 MSI。我们在 AAD 中为 API 创建了应用注册，创建了要访问的角色权限。在Calling your APIs with Azure AD Managed Service Identity using application permissions 之后，我们在尝试将权限/角色分配给 azure 函数时遇到错误： 在PowerShell中：

New-AzureADServiceAppRoleAssignment -ObjectId 8XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -Id 3XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -PrincipalId 8XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -ResourceId 9XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

New-AzureADServiceAppRoleAssignment : Error occurred while executing NewServicePrincipalAppRoleAssignment
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At line:1 char:1
+ New-AzureADServiceAppRoleAssignment -ObjectId 8XXXXXX-XXXX-XXXX-XXXX ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-AzureADServiceAppRoleAssignment], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewServ
   icePrincipalAppRoleAssignment

给我们一个权限错误，即使 AAD 管理员（我认为是 AAD DC 管理员的成员）运行它也是如此。有没有人遇到过这个？为什么这会引发权限错误？我们已经验证了 3 个不同的人的 id 是正确的。

Answer 1

您可能面临的问题是，尽管将您的应用注册命名为与启用 MSI 的应用相同的名称，但两者最终在 AAD 中代表不同的服务主体。 Using app registrations with MSI isn't currently supported.

尝试改用 MSI 身份的对象 ID 运行 powershell 命令。我能够让它工作，并授予我启用 MSI 的应用访问 Graph Api 的权限。

这是我用来分配函数应用所需的 GraphApi 角色的 PS：

$functionAppName = "My-FANCY-FUNC"

$context = Get-AzureRmContext -ErrorAction SilentlyContinue #this lets you search AAD for func

if(!$context){
    $login = Connect-AzureRmAccount  | Out-Null
    Connect-AzureAD #needed this for Graph API
    $context = $login
} else { Write-Host "Login session already established for " $context.Subscription.SubscriptionName }

#get the SP associated with the MSI
$MSIPrincipal = Get-AzureRmADServicePrincipal -SearchString $functionAppName | Where-Object DisplayName -eq $functionAppName

#get the SP associatesd with the MS Graph
$graph = Get-AzureADServicePrincipal -All $true | ? { $_.DisplayName -match "Microsoft Graph" }

#find the target app roles in the graph
$targetRoles = $graph.AppRoles | Where-Object Value -in "Group.ReadWrite.All", "Directory.ReadWrite.All"

#iterate throgh the known roles and add the MSI SP to them
$targetRoles | ForEach-Object {New-AzureADServiceAppRoleAssignment -Id $_.Id -PrincipalId $MSIPrincipal.Id -ObjectId $MSIPrincipal.Id -ResourceId $graph.ObjectId}

根据您的问题，我怀疑此行将返回多个实体：

Get-AzureRmADServicePrincipal -SearchString $functionAppName | Where-Object DisplayName -eq $functionAppName

删除无关的应用注册应该可以清除