Azure 自动化：来自不同租户的服务主体帐户进行身份验证但不 return 服务主体

Question

我在对不同租户中的订阅执行 runbook 时遇到问题。

这是我到目前为止所做的：

1) 创建了密钥库证书。
2) 导出证书的.cer和.PFX。
3) 在 rpgorch-aad 帐户 (300eab96-4619-4b6b-af42-8eb66506ab04)
上创建了一个服务委托人 4) 使用该服务主体的信息在自动化中创建连接
5) 将受密码保护的 PFX 上传到自动化证书存储

首先，来自同一租户的工作示例：

    $connectionName = 'AzureRunasConnection'
"Getting Azure Connection $connectionName"
$servicePrincipalConnection = Get-AutomationConnection -Name $connectionName         
"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $servicePrincipalConnection.TenantID `
    -ApplicationId $servicePrincipalConnection.ApplicationId `
    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $servicePrincipalConnection.TenantID -SubscriptionId $servicePrincipalConnection.SubscriptionId -Verbose
"Writing Output of the Service Principal Connection"
 write-output $servicePrincipalConnection

"Testing getting resource groups."
Get-AzureRmResourceGroup

结果：

Getting Azure Connection AzureRunasConnection  
Logging in to Azure using Add-AzureRmAccount  

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}  
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext  

Setting Context with Set-AzureRmContext  
PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Account               : Redacted  
Environment           : AzureCloud  
Subscription          : Redacted  
Tenant                : Redacted  

Writing Output of the Service Principal Connection  

Name                           Value                                                                                    
----                           -----                                                                                    
SubscriptionId                 Redacted                                                     
TenantId                       Redacted                                                     
ApplicationId                  Redacted                                                     
CertificateThumbprint          Redacted                                                 


Testing getting resource groups.

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
ResourceGroupName     : Redacted  
Location              : eastus  
Resources             :   
ResourcesTable        :   
ProvisioningState     : Succeeded  
Tags                  : {}  
TagsTable             :   
ResourceId            : /subscriptions/Redacted/resourceGroups/Redacted

现在使用相同的代码，但用于其他租户。

$connectionName = 'Redacted'
"Getting Azure Connection"  
$connectionName

$Conn = Get-AutomationConnection -Name $connectionName 

"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $Conn.TenantID `
    -ApplicationId $Conn.ApplicationId `
    -CertificateThumbprint $Conn.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $Conn.TenantID -SubscriptionId $Conn.SubscriptionId -Verbose

"Selecting subscriptionID "
$Conn.SubscriptionID
Select-AzureSubscription -SubscriptionId $Conn.SubscriptionID 

"Testing getting resource groups."
Get-AzureRmResourceGroup

结果：

Getting Azure Connection
RPGOrchResourceManagement

Logging in to Azure using Add-AzureRmAccount

Results: 
PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

Answer 1

我找到了答案。对于其他人，我需要在应用程序 ID 上运行此命令：

        New-AzureRMRoleAssignment -RoleDefinitionName Contributor -ServicePrincipalName $ApplicationId | Write-Verbose -ErrorAction SilentlyContinue

Azure 自动化：来自不同租户的服务主体帐户进行身份验证但不 return 服务主体

Azure Automation: Service Principal account from different tenant authenticates but doesn't return service principal

azure

azure-powershell

azure-automation

azure-rm