权限不足，无法完成使用 Azure Active Directory 图形客户端添加新用户的操作 API

Question

我正在尝试在我的 AD 中添加新用户，但出现错误，因为权限不足，无法完成操作，无法理解 Azure Active Directory Graph API 需要哪些权限，而不会出现此问题下面是我的代码片段，它正在 api 调用 AD Graph

using Microsoft.Azure.ActiveDirectory.GraphClient;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Threading.Tasks;
using System.Web;


namespace AuthenticationPortal
{
    public class ActiveDirectoryClientModel
    {


        // These are the credentials the application will present during authentication
        // and were retrieved from the Azure Management Portal.
        // *** Don't even try to use these - they have been deleted.
        static string clientID = ConfigurationManager.AppSettings["ida:ClientId"];
        static string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];
        static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
        static string domain = ConfigurationManager.AppSettings["ida:Domain"];
        // The Azure AD Graph API is the "resource" we're going to request access to.
        static string resAzureGraphAPI = "https://graph.windows.net";

        // This is the URL the application will authenticate at.
        static string authString = "https://login.microsoft.com/" + tenantId;

        // The Azure AD Graph API for my directory is available at this URL.
        static string serviceRootURL = "https://graph.windows.net/" + domain;

        private ActiveDirectoryClient GetAADClient()
        {
            try
            {
                Uri serviceroot = new Uri(serviceRootURL);
                ActiveDirectoryClient adClient = new ActiveDirectoryClient(serviceroot, async () => await GetAppTokenAsync());
                return adClient;
            }
            catch (Exception ex)
            {
                return null;
            }

        }

        private static async Task<string> GetAppTokenAsync()
        {
            try
            {
                // Instantiate an AuthenticationContext for my directory (see authString above).
                AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

                // Create a ClientCredential that will be used for authentication.
                // This is where the Client ID and Key/Secret from the Azure Management Portal is used.
                ClientCredential clientCred = new ClientCredential(clientID, clientSecret);

                // Acquire an access token from Azure AD to access the Azure AD Graph (the resource)
                // using the Client ID and Key/Secret as credentials.
                AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resAzureGraphAPI, clientCred);
                // Return the access token.
                return authenticationResult.AccessToken;
            }
            catch (Exception ex)
            {
                return null;
            }

        }


        public async Task CreateUser()
        {
            var adClient =  GetAADClient();

            var newUser = new User()
            {
                // Required settings
                DisplayName = "Atul Gandhale",
                UserPrincipalName = "atulm@"+ domain,
                PasswordProfile = new PasswordProfile()
                {
                    Password = "Asdf1234!",
                    ForceChangePasswordNextLogin = true
                },
                MailNickname = "atulg",
                AccountEnabled = true,

                // Some (not all) optional settings
                GivenName = "Atul",
                Surname = "Gandhale",
                JobTitle = "Programmer",
                Department = "Development",
                City = "Pune",
                State = "MH",
                Mobile = "1234567890",
            };
            try
            {
                // Add the user to the directory

                adClient.Users.AddUserAsync(newUser).Wait();
            }
            catch (Exception ex)
            {

            }
        }

    }

}

请帮帮我，我已经发送了几个小时，但无法获得解决方案。

Answer 1

您需要以下权限才能从您的应用程序在 Azure 门户中创建新用户：

权限类型：Delegated permissions

权限名称：Directory.ReadWrite.All

您可以看到 official docs

步骤：1

步骤：2

要记住的要点：

成功添加权限后，您必须添加 Grant consent，如第 2 步所示。

PostMan 测试：

Azure 门户：

注意：但我的建议是使用Microsoft Graph API，现在最推荐使用。对于 Microsoft Graph，您可以参考此 docs

权限不足，无法完成使用 Azure Active Directory 图形客户端添加新用户的操作 API

Insufficient privileges to complete the operation Add new user using Azure Active Directory Graph Client API

asp.net-mvc

azure

azure-ad-graph-api