Azure Powershell - 将用户添加到组，按许可证过滤答案

【问题标题】：Azure Powershell - Add User to Group, filtered by licenseAzure Powershell - 将用户添加到组，按许可证过滤
【发布时间】：2021-10-22 11:24:09
【问题描述】：

一直在尝试创建一个 Powershell 脚本来实现以下目标。

检查哪些用户分配了特定的许可证
将这些用户分配给特定的安全组。

Get-MsolUser | Where-Object {($_.licenses).AccountSkuId -match "DEVELOPERPACK_E5"} | Add-AzureADGroupMember -ObjectID c1ec272d-e0d2-496c-ba65-602e7d822c75

脚本的第一部分运行正常 Get-MsolUser | Where-Object {($_.licenses).AccountSkuId -match "DEVELOPERPACK_E5"} 返回拥有许可证的用户，但是当尝试将结果通过管道传输到“AddAzureADGroupMember”时会发生错误。`

错误：

At line:1 char:1
+ Get-MsolUser | Where-Object {($_.licenses).AccountSkuId -match "DEVEL ...
+ ~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Microsoft.Onlin...omation.GetUser:GetUser) [Get-MsolUser], PipelineStoppedException
    + FullyQualifiedErrorId : System.Management.Automation.PipelineStoppedException: The pipeline has been stopped.
   at System.Management.Automation.CommandProcessor.ProcessRecord()
   at System.Management.Automation.CommandProcessorBase.DoExecute()
   at System.Management.Automation.Internal.Pipe.AddToPipe(Object obj)
   at System.Management.Automation.Internal.Pipe.AddItems(Object objects)
   at System.Security.SecurityContext.Run(SecurityContext securityContext, ContextCallback callback, Object state)
   at System.Management.Automation.MshCommandRuntime.WriteObject(Object sendToPipeline, Boolean enumerateCollection)
   at System.Management.Automation.Cmdlet.WriteObject(Object sendToPipeline, Boolean enumerateCollection)
       at Microsoft.Online.Administration.Automation.MsolCmdlet.ProcessList(SearchDefinition searchDefinition, Int32 maxResultsSize) in X:\bt\1067178\repo\src\dev\PowerShell.V1\modules\psmodule\Cmdlets\MsolCmdlet.cs:line 372,Microsoft.Online.Administration.Automation.G
   etUser

Add-AzureADGroupMember : Error occurred while executing AddGroupMember
Code: Request_BadRequest
Message: Invalid object identifier 'Microsoft.Online.Administration.User'.
RequestId: be0ee2c5-44e0-41f3-a9e2-f8396980cf6b
DateTimeStamp: Fri, 22 Oct 2021 10:37:21 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:1 char:86
+ ... PACK_E5"} | Add-AzureADGroupMember -ObjectId c1ec272d-e0d2-496c-ba65- ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Add-AzureADGroupMember], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.AddGroupMember```

【问题讨论】：

能否请您参考这个docs.microsoft.com/en-us/azure/active-directory/…，它可能会有所帮助

标签： azure powershell azure-active-directory

【解决方案1】：

您收到错误的原因是您没有使用 refobjectiD 。您可以尝试使用下面的cmdlt 和foreach 来满足您的要求

Get-AzureADUser | Where-Object {($_.AssignedLicenses).SkuId -match "*******"} | ForEach-Object { Add-AzureADGroupMember -ObjectID ****** -RefObjectId $_.ObjectId}

这是我的输出截图：

【讨论】：

感谢您，非常感谢。
嗨，我已经运行了该命令，但似乎没有将用户添加到组中。我是否需要将命令的“-ObjectID ******”部分更改为变量，以便它可以遍历每个用户？
-ObjectID ****** 是组的 ID，RefObjectId 是我们从 get-user 命令收集的用户对象 ID。

【解决方案2】：

设法在下面完成了这项工作，感谢所有帮助。

$Users = (Get-MsolUser | Where-Object {($_.licenses).AccountSkuId -match "DEVELOPERPACK_E5"}) | select -expand ObjectId

foreach ($User in $Users) {
Add-AzureADGroupMember -ObjectId 'c1eXXX2d-XXX2-496c-ba65-6XXXXXXXX5' -RefObjectId ($user)
}

【讨论】：