无法使用MS Graph Powershell SDK获取Azure AD用户的自定义安全属性

siv3szwd 于 2023-03-19 发布在 Shell

关注(0)|答案(2)|浏览(179)

对于上下文，我正在构建一个应用程序，它将读取和更新Azure AD用户的自定义安全属性。我使用的是测试版。
下面是我的代码：

# Connect to the client
Function Invoke-Connect-MSGraph($ClientId, $TenantId, $ClientSecret) {
    $body = @{
        'grant_type'    = 'client_credentials'
        'client_id'     = $ClientId
        'client_secret' = $ClientSecret
        # Scope has to be .default when using client cred flow: https://stackoverflow.com/a/51789899/12739456
        'scope'         = 'https://graph.microsoft.com/.default'
    }
    
    $Params = @{
        'Uri'         = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
        'Method'      = 'Post'
        'ContentType' = 'application/x-www-form-urlencoded'
        'Body'        = $body
    }
    
    try {
        $TokenResponse = Invoke-RestMethod @Params
        $AccessToken = $TokenResponse.access_token 

        Connect-MgGraph -AccessToken $AccessToken 
        Select-MgProfile -Name "beta"

        Write-Host "Connected to MS Graph"
    }
    catch [Exception] {
        Write-Error "Error Connecting. Error was: $_.Exception.Message"
        exit
    }
}

# Get User
$EmployeeEmail = "janedoe@xyz.com"
$User = Get-MgUser -Filter "proxyAddresses/any(x:x eq 'smtp:$($EmployeeEmail)')"

# Get Custom Security Attributes 
$Attr = Get-MgUser -UserId $User.Id -Property "customSecurityAttributes"
$AzureCustomSecurityAttributes = Convertfrom-json ($Attr).ToJson()

我得到的错误：Cannot find an overload for "ToJson" and the argument count: "0".似乎$Attr总是返回null。但是我能够获得其他用户属性。
应用程序具有正确的权限：CustomSecAttributeAssignment.ReadWrite.All和User.Read.All我使用的管理员角色也具有Attribute Assignment Administrator角色。
我在这里做错了什么？提前感谢您的输入！
我尝试使用Azure AD PowerShell实现相同的逻辑。它工作正常，但由于Azure AD PowerShell正在被弃用，我需要找到使用MS Graph PowerShell的解决方案。

Azure

来源：https://stackoverflow.com/questions/75736634/cant-get-customsecurityattributes-for-azure-ad-users-with-ms-graph-powershell-s

2条答案

按热度按时间

i5desfxk1#

我同意@user2250152的观点。
这是我的API调用方法

# replace this with yours
$tenantId = "xxx"
$appId = "xxx"
$appSecret = "xxx"

# Define API endpoint and parameters
$authEndpoint = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
$body = @{
    client_id = $appId
    client_secret = $appSecret
    scope = "https://graph.microsoft.com/.default"
    grant_type = "client_credentials"
}

$tokenResponse = Invoke-RestMethod -Method Post -Uri $authEndpoint -Body $body
$accessToken = $tokenResponse.access_token

# Define the headers for the API request
$headers = @{
    Authorization = "Bearer $accessToken"
    ContentType = "application/json"
}

# user u need to read customsecurityattributes
$userupn = "user@yourdomain.com"
# api call uri
$apiEndpoint = "https://graph.microsoft.com/beta/users/$userupn"

# API request
$apiResponse = Invoke-RestMethod -Method Get -Uri $apiEndpoint -Headers $headers

# Output
$apiResponse.customSecurityAttributes

请注意，要检索特定用户that user must be assigned the custom attributes already的自定义安全属性。
你可以参考这个article，它清楚地解释了如何创建自定义安全属性，分配给用户。它使用图形API调用和Azure AD GUI来演示如何做。
使用Azure ad GUI创建属性并分配给用户时，您需要其中一个权限。Attribute Assignment Reader, Attribute Definition Reader, Attribute Assignment Administrator, Attribute Definition Administrator默认情况下，此角色甚至不分配给全局管理员。
参考此Microsoftdoc

赞(0）回复(0）举报 2023-03-19

3wabscal2#

Get-MgUser返回User对象，不需要从json转换结果，直接取CustomSecurityAttributes属性即可

$user = Get-MgUser -UserId $User.Id -Property "customSecurityAttributes"
Write-Output $user.CustomSecurityAttributes

赞(0）回复(0）举报 2023-03-19

我来回答

无法使用MS Graph Powershell SDK获取Azure AD用户的自定义安全属性

2条答案

相关问题

热门标签

最新问答