调用 azure graph api 来获取 Get-PimAzureResourceRoleDefinition

Question

我正在尝试调用 graphapi 来获取角色定义，但出现权限错误，我是否检查过我的服务原则它是否具有所有必需的权限。

Invoke-RestMethod : {
  "error": {
    "code": "UnknownError",
    "message": "{\"errorCode\":\"PermissionScopeNotGranted\",\"message\":\"Authorization failed due to missing permission scope PrivilegedAccess.ReadWrite.AzureResources,PrivilegedAccess.Read.AzureResources.\",\"target\":null,\"details\":null,\"innerError\":null,\"instanceAnnotations\":[],\"typeAnnotation\":null}",
        "innerError": {
          "request-id": "d762f8d4-2cc4-428e-b1ea-7623d8d388f1",
          "date": "2020-06-03T04:25:03"
        }
      }
    }
    At line:38 char:15
    +     $Result = Invoke-RestMethod -Uri $uri -Headers $Headers
    +               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
        + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand




    Below is my code
    ========================

    $TenantName = 'xxxx.onmicrosoft.com'  
    $ClientId = 'xxxxxx'
    $ClientSecret = "xxxxxx"

    # Create a hashtable for the body, the data needed for the token request
    # The variables used are explained above
    $Body = @{
        'tenant' = $TenantId
        'client_id' = $ClientId
        'scope' = 'https://graph.microsoft.com/.default'
        'client_secret' = $ClientSecret
        'grant_type' = 'client_credentials'
    }

    $Params = @{
        'Uri' = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
        'Method' = 'Post'
        'Body' = $Body
        'ContentType' = 'application/x-www-form-urlencoded'
    }

    $AuthResponse = Invoke-RestMethod @Params

    $Headers = @{
        'Authorization' = "Bearer $($AuthResponse.access_token)"
    }

        #Find Pim Role
        $uri = "https://graph.microsoft.com/beta/privilegedAccess/azureResources/resources/xxxxxxxxxxxx/roleDefinitions`?`$filter=displayName eq 'xxxxxx-Contributors'"

    $Result = Invoke-RestMethod -Uri $uri -Headers $Headers

还有如何获取我们在 /resources

之后传入 URL 的角色定义的资源 ID

Answer 1

检查您的 Api permissions，确保选择了 PrivilegedAccess.Read.AzureResources，然后单击按钮 Grant admin consent for xxx。

您可以通过 https://jwt.io/ 解码您的 access_token，scp 显示您的示波器。

更新：

how to get resource id of roledefination which we are passing in URL after /resources

尝试请求这个：

GET https://graph.microsoft.com/beta/privilegedAccess/azureResources/resources

调用 azure graph api 来获取 Get-PimAzureResourceRoleDefinition

calling azure graph api to fetch Get-PimAzureResourceRoleDefinition

azure

azure-ad-graph-api