PowerShell 스크립트 예제는 특정 그룹을 Microsoft Entra 애플리케이션 프록시 애플리케이션에 할당합니다.
Azure 구독없는 경우 시작하기 전에 Azure 체험 계정 만듭니다.
메모
Azure Az PowerShell 모듈을 사용하여 Azure와 상호 작용하는 것이 좋습니다. 시작하려면 Azure PowerShell 설치를 참조하세요. Az PowerShell 모듈로 마이그레이션하는 방법을 알아보려면 Azure PowerShell을 AzureRM에서 Az로 마이그레이션하는 및을 참조하세요.
샘플에는 microsoft Graph Beta PowerShell 모듈 2.10 이상의 필요합니다.
샘플 스크립트
# This sample script assigns a group to a specific Microsoft Entra application proxy application.
#
# Tip: You can identify the parameters by using the following PS commands:
# ServicePrincipalObjectId - Get-MgBetaServicePrincipal -Filter "DisplayName eq '<displayname of the app>'"
# GroupObjectId - Get-MgBetaGroup -ConsistencyLevel eventual -Count userCount -Search '"DisplayName:<name of the group>"'"
#
# Version 1.0
#
# This script requires PowerShell 5.1 (x64) or beyond and one of the following modules:
#
# Microsoft.Graph.Beta ver 2.10 or newer
#
# Before you begin:
#
# Required Microsoft Entra role at least Application Administrator
# or appropriate custom permissions as documented https://learn.microsoft.com/azure/active-directory/roles/custom-enterprise-app-permissions
#
#
param(
[parameter(Mandatory=$true)]
[string] $ServicePrincipalObjectId = "null",
[parameter(Mandatory=$true)]
[string] $GroupObjectId = "null"
)
$servicePrincipalObjectId = $ServicePrincipalObjectId
$groupObjectId = $GroupObjectId
If (($servicePrincipalObjectId -eq "null") -or ($groupObjectId -eq "null")) {
Write-Host "Parameter is missing." -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host " "
Write-Host ".\assign-group-to-app.ps1 -ServicePrincipalObjectId <ObjectId of the Microsoft Entra application proxy application service principal> -UserObjectId <ObjectId of the User>" -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host " "
Write-Host "Hints:" -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host "You can easily identify the parameters by using the following PS commands:" -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host " "
Write-Host "ServicePrincipalObjectId - Get-MgBetaServicePrincipal -Filter "DisplayName eq '<displayname of the app>'" " -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host "UserObjectId - Get-MgBetaGroup -ConsistencyLevel eventual -Count userCount -Search '"DisplayName:<name of the group>"'" -BackgroundColor "Black" -ForegroundColor "Green"
Exit
}
Import-Module Microsoft.Graph.Beta.Applications
Connect-MgGraph -Scope Directory.ReadWrite.All -NoWelcome
New-MgBetaGroupAppRoleAssignment -GroupId $groupObjectId -PrincipalId $groupObjectId -ResourceId $servicePrincipalObjectId -AppRoleId "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"
Write-Host ("")
Write-Host ("Finished.") -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host ("")
Write-Host "To disconnect from Microsoft Graph, please use the Disconnect-MgGraph cmdlet."
스크립트 설명
| 명령 | 노트 |
|---|---|
| Connect-MgGraph | Microsoft Graph에 연결 |
| new-MgBetaGroupAppRoleAssignment | 그룹에 앱 역할 할당 |