使用 PowerShell 或 Microsoft Graph API 配置跨租户同步

项目
04/23/2024

本文介绍使用 Microsoft Graph PowerShell 或 Microsoft Graph API 配置跨租户同步的关键步骤。配置后，Microsoft Entra ID 会自动预配和取消预配目标租户中的 B2B 用户。有关使用 Microsoft Entra 管理中心的详细步骤，请参阅配置跨租户同步。

先决条件

源租户的图标。
源租户

Microsoft Entra ID P1 或 P2 许可证。有关详细信息，请参阅许可证要求。
用于配置跨租户访问设置的安全管理员角色。
用于配置跨租户同步的混合标识管理员角色。
用于将用户分配到某个配置和删除配置的云应用程序管理员或应用程序管理员角色。
用于同意所需权限的全局管理员角色。

目标租户的图标。
目标租户

Microsoft Entra ID P1 或 P2 许可证。有关详细信息，请参阅许可证要求。
用于配置跨租户访问设置的安全管理员角色。
用于同意所需权限的全局管理员角色。

目标租户的图标。
目标租户

PowerShell
Microsoft Graph

启动 PowerShell。
如有必要，请安装 Microsoft Graph PowerShell SDK。

获取源租户和目标租户的租户 ID 并初始化变量。

$SourceTenantId = "<SourceTenantId>"
$TargetTenantId = "<TargetTenantId>"

使用 Connect-MgGraph 命令登录到目标租户并同意以下所需权限。
- Policy.Read.All
- Policy.ReadWrite.CrossTenantAccess
```
Connect-MgGraph -TenantId $TargetTenantId -Scopes "Policy.Read.All","Policy.ReadWrite.CrossTenantAccess"
```

这些步骤描述了如何使用 Microsoft Graph 浏览器，但也可以使用 Postman 或其他 REST API 客户端。

启动 Microsoft Graph 浏览器工具。
登录到目标租户。
选择配置文件，然后选择“同意权限”。
同意以下所需权限。
- Policy.Read.All
- Policy.ReadWrite.CrossTenantAccess
获取源租户和目标租户的租户 ID。本文中所述的示例配置使用以下租户 ID。
- 源租户 ID：{sourceTenantId}
- 目标租户 ID：{targetTenantId}

步骤 2：在目标租户中启用用户同步

目标租户的图标。
目标租户

PowerShell
Microsoft Graph

在目标租户中，使用 New-MgPolicyCrossTenantAccessPolicyPartner 命令在目标租户和源租户之间的跨租户访问策略中创建新的合作伙伴配置。在请求中使用源租户 ID。

如果收到错误 New-MgPolicyCrossTenantAccessPolicyPartner_Create: Another object with the same value for property tenantId already exists，则可能已有现有配置。有关详细信息，请参阅 Symptom - New-MgPolicyCrossTenantAccessPolicyPartner_Create error。

$Params = @{
    TenantId = $SourceTenantId
}
New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter $Params | Format-List

AutomaticUserConsentSettings : Microsoft.Graph.PowerShell.Models.MicrosoftGraphInboundOutboundPolicyConfiguration
B2BCollaborationInbound      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BCollaborationOutbound     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BDirectConnectInbound      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BDirectConnectOutbound     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
IdentitySynchronization      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantIdentitySyncPolicyPartner
InboundTrust                 : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyInboundTrust
IsServiceProvider            :
TenantId                     : <SourceTenantId>
TenantRestrictions           : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyTenantRestrictions
AdditionalProperties         : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#policies/crossTenantAccessPolicy/partners/$entity],
                               [crossCloudMeetingConfiguration,
                               System.Collections.Generic.Dictionary`2[System.String,System.Object]], [protectedContentSharing,
                               System.Collections.Generic.Dictionary`2[System.String,System.Object]]}

使用 Invoke-MgGraphRequest 命令在目标租户中启用用户同步。

如果收到错误 Request_MultipleObjectsWithSameKeyValue，则可能已有现有策略。有关详细信息，请参阅症状 - Request_MultipleObjectsWithSameKeyValue 错误。
```
$Params = @{
    userSyncInbound = @{
        isSyncAllowed = $true
    }
}
Invoke-MgGraphRequest -Method PUT -Uri "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/$SourceTenantId/identitySynchronization" -Body $Params
```

使用 Get-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization 命令验证 IsSyncAllowed 是否设置为 True。

(Get-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization -CrossTenantAccessPolicyConfigurationPartnerTenantId $SourceTenantId).UserSyncInbound

IsSyncAllowed
-------------
True

在目标租户中，使用 Create crossTenantAccessPolicyConfigurationPartner API 在目标租户和源租户之间的跨租户访问策略中创建新的合作伙伴配置。在请求中使用源租户 ID。

如果收到错误 Request_MultipleObjectsWithSameKeyValue，则可能已有现有配置。有关详细信息，请参阅症状 - Request_MultipleObjectsWithSameKeyValue 错误。

请求

POST https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners
Content-Type: application/json

{
  "tenantId": "{sourceTenantId}"
}

响应

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/crossTenantAccessPolicy/partners/$entity",
  "tenantId": "{sourceTenantId}",
  "isServiceProvider": null,
  "inboundTrust": null,
  "b2bCollaborationOutbound": null,
  "b2bCollaborationInbound": null,
  "b2bDirectConnectOutbound": null,
  "b2bDirectConnectInbound": null,
  "tenantRestrictions": null,
  "crossCloudMeetingConfiguration":
  {
    "inboundAllowed": null,
    "outboundAllowed": null
  },
  "automaticUserConsentSettings":
  {
    "inboundAllowed": null,
    "outboundAllowed": null
  }
}

使用 Create identitySynchronization API 在目标租户中启用用户同步。

如果收到错误 Request_MultipleObjectsWithSameKeyValue，则可能已有现有策略。有关详细信息，请参阅症状 - Request_MultipleObjectsWithSameKeyValue 错误。

请求

PUT https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/{sourceTenantId}/identitySynchronization
Content-type: application/json

{
   "displayName": "Fabrikam",
   "userSyncInbound": 
    {
      "isSyncAllowed": true
    }
}

响应

HTTP/1.1 204 No Content

步骤 3：在目标租户中自动兑换邀请

目标租户的图标。
目标租户

PowerShell
Microsoft Graph

在目标租户中，使用 Update-MgPolicyCrossTenantAccessPolicyPartner 命令自动兑换邀请并禁止入站访问的同意提示。

$AutomaticUserConsentSettings = @{
    "InboundAllowed"="True"
}
Update-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $SourceTenantId -AutomaticUserConsentSettings $AutomaticUserConsentSettings

在目标租户中，使用 Update crossTenantAccessPolicyConfigurationPartner API 自动兑换邀请并禁止入站访问的同意提示。

请求

PATCH https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/{sourceTenantId}
Content-Type: application/json

{
    "inboundTrust": null,
    "automaticUserConsentSettings":
    {
        "inboundAllowed": true
    }
}

响应

HTTP/1.1 204 No Content

源租户的图标。
源租户

PowerShell
Microsoft Graph

启动 PowerShell 的实例。

获取源租户和目标租户的租户 ID 并初始化变量。

$SourceTenantId = "<SourceTenantId>"
$TargetTenantId = "<TargetTenantId>"

使用 Connect-MgGraph 命令登录到源租户并同意以下所需权限。
- Policy.Read.All
- Policy.ReadWrite.CrossTenantAccess
- Application.ReadWrite.All
- Directory.ReadWrite.All
- AuditLog.Read.All
```
Connect-MgGraph -TenantId $SourceTenantId -Scopes "Policy.Read.All","Policy.ReadWrite.CrossTenantAccess","Application.ReadWrite.All","Directory.ReadWrite.All","AuditLog.Read.All"
```

步骤 5：在源租户中自动兑换邀请

源租户的图标。
源租户

PowerShell
Microsoft Graph

在源租户中，使用 New-MgPolicyCrossTenantAccessPolicyPartner 命令在源租户和目标租户之间的跨租户访问策略中创建新的合作伙伴配置。在请求中使用目标租户 ID。

$Params = @{
    TenantId = $TargetTenantId
}
New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter $Params | Format-List

AutomaticUserConsentSettings : Microsoft.Graph.PowerShell.Models.MicrosoftGraphInboundOutboundPolicyConfiguration
B2BCollaborationInbound      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BCollaborationOutbound     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BDirectConnectInbound      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
B2BDirectConnectOutbound     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyB2BSetting
IdentitySynchronization      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantIdentitySyncPolicyPartner
InboundTrust                 : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyInboundTrust
IsServiceProvider            :
TenantId                     : <TargetTenantId>
TenantRestrictions           : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCrossTenantAccessPolicyTenantRestrictions
AdditionalProperties         : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#policies/crossTenantAccessPolicy/partners/$entity],
                               [crossCloudMeetingConfiguration,
                               System.Collections.Generic.Dictionary`2[System.String,System.Object]], [protectedContentSharing,
                               System.Collections.Generic.Dictionary`2[System.String,System.Object]]}

使用 Update-MgPolicyCrossTenantAccessPolicyPartner 命令自动兑换邀请并禁止出站访问的同意提示。

$AutomaticUserConsentSettings = @{
    "OutboundAllowed"="True"
}
Update-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $TargetTenantId -AutomaticUserConsentSettings $AutomaticUserConsentSettings

在源租户中，使用 Create crossTenantAccessPolicyConfigurationPartner API 在源租户和目标租户之间的跨租户访问策略中创建新的合作伙伴配置。在请求中使用目标租户 ID。

如果收到错误 Request_MultipleObjectsWithSameKeyValue，则可能已有现有配置。有关详细信息，请参阅症状 - Request_MultipleObjectsWithSameKeyValue 错误。

请求

POST https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners
Content-Type: application/json

{
  "tenantId": "{targetTenantId}"
}

响应

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/crossTenantAccessPolicy/partners/$entity",
  "tenantId": "{targetTenantId}",
  "isServiceProvider": null,
  "inboundTrust": null,
  "b2bCollaborationOutbound": null,
  "b2bCollaborationInbound": null,
  "b2bDirectConnectOutbound": null,
  "b2bDirectConnectInbound": null,
  "tenantRestrictions": null,
  "crossCloudMeetingConfiguration":
  {
    "inboundAllowed": null,
    "outboundAllowed": null
  },
  "automaticUserConsentSettings":
  {
    "inboundAllowed": null,
    "outboundAllowed": null
  }
}

使用 Update crossTenantAccessPolicyConfigurationPartner API 自动兑换邀请并禁止出站访问的同意提示。

请求

PATCH https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/{targetTenantId}
Content-Type: application/json

{
    "automaticUserConsentSettings":
    {
        "outboundAllowed": true
    }
}

响应

HTTP/1.1 204 No Content

步骤 6：在源租户中创建配置应用程序

源租户的图标。
源租户

PowerShell
Microsoft Graph

在源租户中，使用 Invoke-MgInstantiateApplicationTemplate 命令将配置应用程序的实例从 Microsoft Entra 应用程序库添加到租户中。
```
Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId "518e5f48-1fc8-4c48-9387-9fdf28b0dfe7" -DisplayName "Fabrikam"
```

使用 Get-MgServicePrincipal 命令获取服务主体 ID 和应用角色 ID。

Get-MgServicePrincipal -Filter "DisplayName eq 'Fabrikam'" | Format-List

AccountEnabled                      : True
AddIns                              : {}
AlternativeNames                    : {}
AppDescription                      :
AppDisplayName                      : Fabrikam
AppId                               : <AppId>
AppManagementPolicies               :
AppOwnerOrganizationId              : <AppOwnerOrganizationId>
AppRoleAssignedTo                   :
AppRoleAssignmentRequired           : True
AppRoleAssignments                  :
AppRoles                            : {<AppRoleId>}
ApplicationTemplateId               : 518e5f48-1fc8-4c48-9387-9fdf28b0dfe7
ClaimsMappingPolicies               :
CreatedObjects                      :
CustomSecurityAttributes            : Microsoft.Graph.PowerShell.Models.MicrosoftGraphCustomSecurityAttributeValue
DelegatedPermissionClassifications  :
DeletedDateTime                     :
Description                         :
DisabledByMicrosoftStatus           :
DisplayName                         : Fabrikam
Endpoints                           :
ErrorUrl                            :
FederatedIdentityCredentials        :
HomeRealmDiscoveryPolicies          :
Homepage                            : https://account.activedirectory.windowsazure.com:444/applications/default.aspx?metadata=aad2aadsync|ISV9.1|primary|z
Id                                  : <ServicePrincipalId>
Info                                : Microsoft.Graph.PowerShell.Models.MicrosoftGraphInformationalUrl
KeyCredentials                      : {}
LicenseDetails                      :

...

初始化服务主体 ID 的变量。

请务必使用服务主体 ID 而不是应用程序 ID。
```
$ServicePrincipalId = "<ServicePrincipalId>"
```
初始化应用角色 ID 的变量。
```
$AppRoleId= "<AppRoleId>"
```

在源租户中，使用 applicationTemplate: instantiate API 将配置应用程序的实例从 Microsoft Entra 应用程序库添加到租户中。

Request

POST https://graph.microsoft.com/v1.0/applicationTemplates/518e5f48-1fc8-4c48-9387-9fdf28b0dfe7/instantiate
Content-type: application/json

{
  "displayName": "Fabrikam"
}

响应

HTTP/1.1 201 Created
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.applicationServicePrincipal",
    "application": {
        "id": "{id}",
        "appId": "{appId}",
        "applicationTemplateId": "518e5f48-1fc8-4c48-9387-9fdf28b0dfe7",
        "createdDateTime": "2023-07-31T23:26:24Z",
        "deletedDateTime": null,
        "displayName": "Fabrikam",
        "description": null,
        "groupMembershipClaims": null,
        "identifierUris": [],
        "isFallbackPublicClient": false,
        "signInAudience": "AzureADMyOrg",
        "tags": [],
        "tokenEncryptionKeyId": null,
        "defaultRedirectUri": null,
        "optionalClaims": null,
        "addIns": [],
        "api": {
            "acceptMappedClaims": null,
            "knownClientApplications": [],
            "requestedAccessTokenVersion": null,
            "oauth2PermissionScopes": [
                {
                    "adminConsentDescription": "Allow the application to access Fabrikam on behalf of the signed-in user.",
                    "adminConsentDisplayName": "Access Fabrikam",
                    "id": "{id}",
                    "isEnabled": true,
                    "type": "User",
                    "userConsentDescription": "Allow the application to access Fabrikam on your behalf.",
                    "userConsentDisplayName": "Access Fabrikam",
                    "value": "user_impersonation"
                }
            ],
            "preAuthorizedApplications": []
        },
        "appRoles": [
            {
                "allowedMemberTypes": [
                    "User"
                ],
                "displayName": "msiam_access",
                "id": "{appRoleId}",
                "isEnabled": true,
                "description": "msiam_access",
                "value": null,
                "origin": "Application"
            }
        ],
        "info": {
            "logoUrl": null,
            "marketingUrl": null,
            "privacyStatementUrl": null,
            "supportUrl": null,
            "termsOfServiceUrl": null
        },
        "keyCredentials": [],
        "parentalControlSettings": {
            "countriesBlockedForMinors": [],
            "legalAgeGroupRule": "Allow"
        },
        "passwordCredentials": [],
        "publicClient": {
            "redirectUris": []
        },
        "requiredResourceAccess": [],
        "verifiedPublisher": {
            "displayName": null,
            "verifiedPublisherId": null,
            "addedDateTime": null
        },
        "web": {
            "homePageUrl": "https://account.activedirectory.windowsazure.com:444/applications/default.aspx?metadata=aad2aadsync|ISV9.1|primary|z",
            "redirectUris": [],
            "logoutUrl": null
        }
    },
    "servicePrincipal": {
        "id": "{servicePrincipalId}",
        "deletedDateTime": null,
        "accountEnabled": true,
        "appId": "{appId}",
        "applicationTemplateId": "518e5f48-1fc8-4c48-9387-9fdf28b0dfe7",
        "appDisplayName": "Fabrikam",
        "alternativeNames": [],
        "appOwnerOrganizationId": "{appOwnerOrganizationId}",
        "displayName": "Fabrikam",
        "appRoleAssignmentRequired": true,
        "loginUrl": null,
        "logoutUrl": null,
        "homepage": "https://account.activedirectory.windowsazure.com:444/applications/default.aspx?metadata=aad2aadsync|ISV9.1|primary|z",
        "notificationEmailAddresses": [],
        "preferredSingleSignOnMode": null,
        "preferredTokenSigningKeyThumbprint": null,
        "replyUrls": [],
        "servicePrincipalNames": [
            "{appId}"
        ],
        "servicePrincipalType": "Application",
        "tags": [
            "WindowsAzureActiveDirectoryIntegratedApp"
        ],
        "tokenEncryptionKeyId": null,
        "samlSingleSignOnSettings": null,
        "addIns": [],
        "appRoles": [
            {
                "allowedMemberTypes": [
                    "User"
                ],
                "displayName": "msiam_access",
                "id": "{appRoleId}",
                "isEnabled": true,
                "description": "msiam_access",
                "value": null,
                "origin": "Application"
            }
        ],
        "info": {
            "logoUrl": null,
            "marketingUrl": null,
            "privacyStatementUrl": null,
            "supportUrl": null,
            "termsOfServiceUrl": null
        },
        "keyCredentials": [],
        "oauth2PermissionScopes": [
            {
                "adminConsentDescription": "Allow the application to access Fabrikam on behalf of the signed-in user.",
                "adminConsentDisplayName": "Access Fabrikam",
                "id": "{id}",
                "isEnabled": true,
                "type": "User",
                "userConsentDescription": "Allow the application to access Fabrikam on your behalf.",
                "userConsentDisplayName": "Access Fabrikam",
                "value": "user_impersonation"
            }
        ],
        "passwordCredentials": [],
        "verifiedPublisher": {
            "displayName": null,
            "verifiedPublisherId": null,
            "addedDateTime": null
        }
    }
}

保存 servicePrincipalId。

请务必使用服务主体 ID 而不是应用程序 ID。
保存 appRoleId。

步骤 7：测试与目标租户的连接

源租户的图标。
源租户

PowerShell
Microsoft Graph

在源租户中，使用 Invoke-MgGraphRequest 命令测试与目标租户的连接并验证凭据。

$Params = @{
    "useSavedCredentials" = $false
    "templateId" = "Azure2Azure"
    "credentials" = @(
        @{
            "key" = "CompanyId"
            "value" = $TargetTenantId
        }
        @{
            "key" = "AuthenticationType"
            "value" = "SyncPolicy"
        }
    )
}
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$ServicePrincipalId/synchronization/jobs/validateCredentials" -Body $Params

在源租户中，使用 synchronizationJob: validateCredentials API 测试与目标租户的连接并验证凭据。

请求

POST https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/validateCredentials
Content-Type: application/json

{
    "useSavedCredentials": false,
    "templateId": "Azure2Azure",
    "credentials": [
        {
            "key": "CompanyId",
            "value": "{targetTenantId}"
        },
        {
            "key": "AuthenticationType",
            "value": "SyncPolicy"
        }
    ]
}

响应

HTTP/1.1 204 No Content

步骤 8：在源租户中创建预配作业

源租户的图标。
源租户

在源租户中，若要启用预配，请创建预配作业。

PowerShell
Microsoft Graph

确定要使用的同步模板，例如 Azure2Azure。

模板具有已预配置的同步设置。

在源租户中，使用 New-MgServicePrincipalSynchronizationJob 命令基于模板创建预配作业。

New-MgServicePrincipalSynchronizationJob -ServicePrincipalId $ServicePrincipalId -TemplateId "Azure2Azure" | Format-List

Id                         : <JobId>
Schedule                   : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationSchedule
Schema                     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationSchema
Status                     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationStatus
SynchronizationJobSettings : {AzureIngestionAttributeOptimization, LookaheadQueryEnabled}
TemplateId                 : Azure2Azure
AdditionalProperties       : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('<ServicePrincipalId>')/synchro
                             nization/jobs/$entity]}

初始化作业 ID 的变量。
```
$JobId = "<JobId>"
```

确定要使用的同步模板，例如 Azure2Azure。

模板具有已预配置的同步设置。

在源租户中，使用 Create synchronizationJob API 基于模板创建预配作业。

请求

POST https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs
Content-type: application/json

{
    "templateId": "Azure2Azure"
}

响应

HTTP/1.1 201 Created
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('{servicePrincipalId}')/synchronization/jobs/$entity",
    "id": "{jobId}",
    "templateId": "Azure2Azure",
    "schedule": {
        "expiration": null,
        "interval": "PT40M",
        "state": "Disabled"
    },
    "status": {
        "countSuccessiveCompleteFailures": 0,
        "escrowsPruned": false,
        "code": "Paused",
        "lastExecution": null,
        "lastSuccessfulExecution": null,
        "lastSuccessfulExecutionWithExports": null,
        "quarantine": null,
        "steadyStateFirstAchievedTime": "0001-01-01T00:00:00Z",
        "steadyStateLastAchievedTime": "0001-01-01T00:00:00Z",
        "troubleshootingUrl": null,
        "progress": [],
        "synchronizedEntryCountByType": []
    },
    "synchronizationJobSettings": [
        {
            "name": "AzureIngestionAttributeOptimization",
            "value": "False"
        },
        {
            "name": "LookaheadQueryEnabled",
            "value": "False"
        }
    ]
}

保存 jobId。

步骤 9：保存凭据

源租户的图标。
源租户

PowerShell
Microsoft Graph

在源租户中，使用 Invoke-MgGraphRequest 命令保存你的凭据。

$Params = @{
    "value" = @(
        @{
            "key" = "AuthenticationType"
            "value" = "SyncPolicy"
        }
        @{
            "key" = "CompanyId"
            "value" = $TargetTenantId
        }
    )
}
Invoke-MgGraphRequest -Method PUT -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$ServicePrincipalId/synchronization/secrets" -Body $Params

在源租户中，使用添加同步机密 API 保存凭据。

请求

PUT https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/secrets 
Content-Type: application/json

{
    "value": [
        {
            "key": "AuthenticationType",
            "value": "SyncPolicy"
        },
        {
            "key": "CompanyId",
            "value": "{targetTenantId}"
        },
        {
            "key": "SyncNotificationSettings",
            "value": "{\"Enabled\":false,\"DeleteThresholdEnabled\":false,\"HumanResourcesLookaheadQueryEnabled\":false}"
        },
        {
            "key": "SyncAll",
            "value": "false"
        }
    ]
}

响应

HTTP/1.1 204 No Content

步骤 10：将用户分配到配置

源租户的图标。
源租户

若要使跨租户同步工作，必须向配置分配至少一个内部用户。

PowerShell
Microsoft Graph

在源租户中，使用 New-MgServicePrincipalAppRoleAssignedTo 命令将内部用户分配到配置。

$Params = @{
    PrincipalId = "<PrincipalId>"
    ResourceId = $ServicePrincipalId
    AppRoleId = $AppRoleId
}
New-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $ServicePrincipalId -BodyParameter $Params | Format-List

AppRoleId            : <AppRoleId>
CreatedDateTime      : 7/31/2023 10:27:12 PM
DeletedDateTime      :
Id                   : <Id>
PrincipalDisplayName : User1
PrincipalId          : <PrincipalId>
PrincipalType        : User
ResourceDisplayName  : Fabrikam
ResourceId           : <ServicePrincipalId>
AdditionalProperties : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#appRoleAssignments/$entity]}

在源租户中，使用 Grant an appRoleAssignment for a service principal API 将内部用户分配到配置。

请求

POST https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/appRoleAssignedTo
Content-type: application/json

{
    "appRoleId": "{appRoleId}",
    "resourceId": "{servicePrincipalId}",
    "principalId": "{principalId}"
}

响应

HTTP/1.1 201 Created
Content-Type: application/json
{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('{servicePrincipalId}')/appRoleAssignedTo/$entity",
    "id": "{keyId}",
    "deletedDateTime": null,
    "appRoleId": "{appRoleId}",
    "createdDateTime": "2023-07-31T22:23:48.6541804Z",
    "principalDisplayName": "User1",
    "principalId": "{principalId}",
    "principalType": "User",
    "resourceDisplayName": "Fabrikam",
    "resourceId": "{servicePrincipalId}"
}

步骤 11：测试按需预配

源租户的图标。
源租户

完成配置后，可以使用其中一个用户测试按需预配。

PowerShell
Microsoft Graph

在源租户中，使用 Get-MgServicePrincipalSynchronizationJobSchema 命令获取架构规则 ID。

$SynchronizationSchema = Get-MgServicePrincipalSynchronizationJobSchema -ServicePrincipalId $ServicePrincipalId -SynchronizationJobId $JobId
$SynchronizationSchema.SynchronizationRules | Format-List

ContainerFilter      : Microsoft.Graph.PowerShell.Models.MicrosoftGraphContainerFilter
Editable             : True
GroupFilter          : Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroupFilter
Id                   : <RuleId>
Metadata             : {defaultSourceObjectMappings, supportsProvisionOnDemand}
Name                 : USER_INBOUND_USER
ObjectMappings       : {Provision Azure Active Directory Users, , , …}
Priority             : 1
SourceDirectoryName  : Azure Active Directory
TargetDirectoryName  : Azure Active Directory (target tenant)
AdditionalProperties : {}

初始化规则 ID 的变量。
```
$RuleId = "<RuleId>"
```

使用 New-MgServicePrincipalSynchronizationJobOnDemand 命令按需预配某个测试用户。

$Params = @{
    Parameters = @(
        @{
            Subjects = @(
                @{
                    ObjectId = "<UserObjectId>"
                    ObjectTypeName = "User"
                }
            )
            RuleId = $RuleId
        }
    )
}
New-MgServicePrincipalSynchronizationJobOnDemand -ServicePrincipalId $ServicePrincipalId -SynchronizationJobId $JobId -BodyParameter $Params | Format-List

Key                  : Microsoft.Identity.Health.CPP.Common.DataContracts.SyncFabric.StatusInfo
Value                : [{"provisioningSteps":[{"name":"EntryImport","type":"Import","status":"Success","description":"Retrieved User
                       'user1@fabrikam.com' from Azure Active Directory","timestamp":"2023-07-31T22:31:15.9116590Z","details":{"objectId":
                       "<UserObjectId>","accountEnabled":"True","displayName":"User1","mailNickname":"user1","userPrincipalName":"use
                       ...
AdditionalProperties : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.stringKeyStringValuePair]}

在源租户中，使用获取 synchronizationSchema API 获取架构规则 ID。

请求

GET https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/schema

响应

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('{servicePrincipalId}')/synchronization/jobs('{jobId}')/schema/$entity",
    "id": "{jobId}",
    "version": "v1.2",
    "synchronizationRules": [
        {
            "containerFilter": null,
            "editable": true,
            "groupFilter": null,
            "id": "{ruleId}",
            "name": "USER_INBOUND_USER",
            "priority": 1,
            "sourceDirectoryName": "Azure Active Directory",
            "targetDirectoryName": "Azure Active Directory (target tenant)",
            "metadata": [

            ...

在源租户中，使用 synchronizationJob: provisionOnDemand API 按需预配某个测试用户。

请求

POST https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/provisionOnDemand
Content-Type: application/json

{
    "parameters": [
        {
            "ruleId": "{ruleId}",
            "subjects": [
                {
                    "objectId": "{userObjectId}",
                    "objectTypeName": "User"
                }
            ]
        }
    ]
}

响应

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.stringKeyStringValuePair",
    "key": "Microsoft.Identity.Health.CPP.Common.DataContracts.SyncFabric.StatusInfo",
    "value": "[{\"provisioningSteps\":[{\"name\":\"EntryImport\",\"type\":\"Import\",\"status\":\"Success\",\"description\":\"Retrieved User 'user1@fabrikam.com' from Azure Active Directory\",\"timestamp\":\"2023-07-31T00:00:16.7866324Z\",\"details\":{\"objectId\":\"{userObjectId}\",\"accountEnabled\":\"True\",\"displayName\":\"User1\",\"mailNickname\":\"user1\",\"userPrincipalName\":\"user1@fabrikam.com\",}

    ...

步骤 12：启动预配作业

源租户的图标。
源租户

PowerShell
Microsoft Graph

配置预配作业后，请在源租户中使用 Start-MgServicePrincipalSynchronizationJob 命令启动预配作业。
```
Start-MgServicePrincipalSynchronizationJob -ServicePrincipalId $ServicePrincipalId -SynchronizationJobId $JobId
```

配置预配作业后，请在源租户中使用 Start synchronizationJob API 启动预配作业。

请求

POST https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/start

响应

HTTP/1.1 204 No Content

步骤 13：监视预配

源租户的图标。
源租户

PowerShell
Microsoft Graph

现在预配作业正在运行，请在源租户中使用 Get-MgServicePrincipalSynchronizationJob 命令监视当前预配周期的进度以及到目前为止的统计信息，例如已在目标系统中创建的用户和组数。

Get-MgServicePrincipalSynchronizationJob -ServicePrincipalId $ServicePrincipalId -SynchronizationJobId $JobId | Format-List

Id                         : <JobId>
Schedule                   : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationSchedule
Schema                     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationSchema
Status                     : Microsoft.Graph.PowerShell.Models.MicrosoftGraphSynchronizationStatus
SynchronizationJobSettings : {AzureIngestionAttributeOptimization, LookaheadQueryEnabled}
TemplateId                 : Azure2Azure
AdditionalProperties       : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('<ServicePrincipalId>')/synchro
                             nization/jobs/$entity]}

除了监视预配作业的状态外，还可以使用 Get-MgAuditLogProvisioning 命令检索预配日志并获取发生的所有预配事件。例如，查询特定用户并确定他们是否已成功预配。

Get-MgAuditLogDirectoryAudit | Select -First 10 | Format-List

ActivityDateTime     : 7/31/2023 12:08:17 AM
ActivityDisplayName  : Export
AdditionalDetails    : {Details, ErrorCode, EventName, ipaddr...}
Category             : ProvisioningManagement
CorrelationId        : cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec
Id                   : Sync_cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec_L5BFV_161778479
InitiatedBy          : Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuditActivityInitiator1
LoggedByService      : Account Provisioning
OperationType        :
Result               : success
ResultReason         : User 'user2@fabrikam.com' was created in Azure Active Directory (target tenant)
TargetResources      : {<ServicePrincipalId>, }
AdditionalProperties : {}

ActivityDateTime     : 7/31/2023 12:08:17 AM
ActivityDisplayName  : Export
AdditionalDetails    : {Details, ErrorCode, EventName, ipaddr...}
Category             : ProvisioningManagement
CorrelationId        : cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec
Id                   : Sync_cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec_L5BFV_161778264
InitiatedBy          : Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuditActivityInitiator1
LoggedByService      : Account Provisioning
OperationType        :
Result               : success
ResultReason         : User 'user2@fabrikam.com' was updated in Azure Active Directory (target tenant)
TargetResources      : {<ServicePrincipalId>, }
AdditionalProperties : {}

ActivityDateTime     : 7/31/2023 12:08:14 AM
ActivityDisplayName  : Synchronization rule action
AdditionalDetails    : {Details, ErrorCode, EventName, ipaddr...}
Category             : ProvisioningManagement
CorrelationId        : cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec
Id                   : Sync_cc519f3b-fb72-4ea2-9b7b-8f9dc271c5ec_L5BFV_161778395
InitiatedBy          : Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuditActivityInitiator1
LoggedByService      : Account Provisioning
OperationType        :
Result               : success
ResultReason         : User 'user2@fabrikam.com' will be created in Azure Active Directory (target tenant) (User is active and assigned
                       in Azure Active Directory, but no matching User was found in Azure Active Directory (target tenant))
TargetResources      : {<ServicePrincipalId>, }
AdditionalProperties : {}

现在预配作业正在运行，请在源租户中使用 Get synchronizationJob API 监视当前预配周期的进度以及到目前为止的统计信息，例如已在目标系统中创建的用户和组数。

请求

GET https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}

响应

HTTP/1.1 200 OK
Content-type: application/json

{
    "id": "{jobId}",
    "templateId": "Azure2Azure",
    "schedule": {
        "expiration": null,
        "interval": "PT40M",
        "state": "Active"
    },
    "status": {
        "countSuccessiveCompleteFailures": 0,
        "escrowsPruned": false,
        "code": "NotRun",
        "lastSuccessfulExecution": null,
        "lastSuccessfulExecutionWithExports": null,
        "quarantine": null,
        "steadyStateFirstAchievedTime": "0001-01-01T00:00:00Z",
        "steadyStateLastAchievedTime": "0001-01-01T00:00:00Z",
        "troubleshootingUrl": "",
        "lastExecution": {
            "activityIdentifier": null,
            "countEntitled": 0,
            "countEntitledForProvisioning": 0,
            "countEscrowed": 0,
            "countEscrowedRaw": 0,
            "countExported": 0,
            "countExports": 0,
            "countImported": 0,
            "countImportedDeltas": 0,
            "countImportedReferenceDeltas": 0,
            "state": "Failed",
            "timeBegan": "0001-01-01T00:00:00Z",
            "timeEnded": "0001-01-01T00:00:00Z",
            "error": {
                "code": "None",
                "message": "",
                "tenantActionable": false
            }
        },
        "progress": [],
        "synchronizedEntryCountByType": []
    },
    "synchronizationJobSettings": [
        {
            "name": "AzureIngestionAttributeOptimization",
            "value": "False"
        },
        {
            "name": "LookaheadQueryEnabled",
            "value": "False"
        }
    ]
}

除了监视预配作业的状态外，还可以使用 List provisioningObjectSummary API 检索预配日志并获取发生的所有预配事件。例如，查询特定用户并确定他们是否已成功预配。

请求

GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=((contains(tolower(servicePrincipal/id), '{servicePrincipalId}') or contains(tolower(servicePrincipal/displayName), '{servicePrincipalId}')) and activityDateTime gt 2023-07-30 and activityDateTime lt 2023-07-31)&$top=500&$orderby=activityDateTime desc

响应

为方便阅读，此处显示的响应对象已缩短。

HTTP/1.1 200 OK
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#auditLogs/provisioning",
    "value": [
        {
            "id": "{id}",
            "activityDateTime": "2023-07-31T00:40:37Z",
            "tenantId": "{targetTenantId}",
            "jobId": "{jobId}",
            "cycleId": "{cycleId}",
            "changeId": "{changeId}",
            "provisioningAction": "create",
            "durationInMilliseconds": 4375,
            "servicePrincipal": {
                "id": "{servicePrincipalId}",
                "displayName": "Fabrikam"
            },
            "sourceSystem": {
                "id": "{id}",
                "displayName": "Azure Active Directory",
                "details": {}
            },
            "targetSystem": {
                "id": "{id}",
                "displayName": "Azure Active Directory (target tenant)",
                "details": {
                    "ApplicationId": "{applicationId}",
                    "ServicePrincipalId": "{servicePrincipalId}",
                    "ServicePrincipalDisplayName": "Fabrikam"
                }
            },
            "initiatedBy": {
                "id": "",
                "displayName": "Azure AD Provisioning Service",
                "initiatorType": "system"
            },
            "sourceIdentity": {
                "id": "{sourceUserObjectId}",
                "displayName": "User4",
                "identityType": "User",
                "details": {
                    "id": "{sourceUserObjectId}",
                    "odatatype": "User",
                    "DisplayName": "User4",
                    "UserPrincipalName": "user4@fabrikam.com"
                }
            },
            "targetIdentity": {
                "id": "{targetUserObjectId}",
                "displayName": "",
                "identityType": "User",
                "details": {}
            },
            "provisioningStatusInfo": {
                "status": "success",
                "errorInformation": null
            },
        "provisioningSteps": [
            {
                "name": "EntryImportAdd",
                "provisioningStepType": "import",
                "status": "success",
                "description": "Received User 'user4@fabrikam.com' change of type (Add) from Azure Active Directory",
                "details": {
                    "objectId": "{sourceUserObjectId}",
                    "accountEnabled": "True",
                    "department": "Marketing",
                    "displayName": "User4",
                    "mailNickname": "user4",
                    "userPrincipalName": "user4@fabrikam.com",
                    "netId": "{netId}",
                    "showInAddressList": "",
                    "alternativeSecurityIds": "None",
                    "IsSoftDeleted": "False",
                    "appRoleAssignments": "msiam_access"
                }
            },
            {
                "name": "EntrySynchronizationScoping",
                "provisioningStepType": "scoping",
                "status": "success",
                "description": "Determine if User in scope by evaluating against each scoping filter",
                "details": {
                    "Active in the source system": "True",
                    "Assigned to the application": "True",
                    "User has the required role": "True",
                    "Scoping filter evaluation passed": "True",
                    "ScopeEvaluationResult": "{\"Marketing department filter.department EQUALS 'Marketing'\":true}"
                }
            },

            ...

        }
    ]
}

故障描述 - 权限不足错误

尝试执行操作时，你收到如下所示的错误消息：

code: Authorization_RequestDenied
message: Insufficient privileges to complete the operation.

原因

登录用户没有足够的权限，或者你需要同意其中一个所需的权限。

解决方案

确保为你分配了所需的角色。请参阅本文前面的先决条件。
使用 Connect-MgGraph 登录时，请确保指定所需的范围。请参阅本文前面的步骤 1：登录到目标租户和步骤 4：登录到源租户。

症状 - New-MgPolicyCrossTenantAccessPolicyPartner_Create 错误

尝试创建新的合作伙伴配置时，会收到类似于以下内容的错误消息：

New-MgPolicyCrossTenantAccessPolicyPartner_Create: Another object with the same value for property tenantId already exists.

原因

你可能正在试图根据以前的配置创建一个已经存在的配置或对象。

解决方案

检查你的语法以及你使用的租户 ID 是否正确。
使用 Get-MgPolicyCrossTenantAccessPolicyPartner 命令列出现有对象。
如果你有现有的对象，则可能需要使用 Update-MgPolicyCrossTenantAccessPolicyPartner 进行更新

症状 - Request_MultipleObjectsWithSameKeyValue 错误

尝试启用用户同步时，会收到类似于以下内容的错误消息：

Invoke-MgGraphRequest: PUT https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/<SourceTenantId>/identitySynchronization
HTTP/1.1 409 Conflict
...
{"error":{"code":"Request_MultipleObjectsWithSameKeyValue","message":"A conflicting object with one or more of the specified property values is present in the directory.","details":[{"code":"ConflictingObjects","message":"A conflicting object with one or more of the specified property values is present in the directory.", ... }}}

原因

你可能正在试图根据以前的配置创建一个已经存在的策略。

解决方案

检查你的语法以及你使用的租户 ID 是否正确。

使用 Get-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization 命令列出 IsSyncAllowed 设置。

(Get-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization -CrossTenantAccessPolicyConfigurationPartnerTenantId $SourceTenantId).UserSyncInbound

如果你已有策略，则可能需要使用 Set-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization 命令进行更新，以启用用户同步。

$Params = @{
    userSyncInbound = @{
        isSyncAllowed = $true
    }
}
Set-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization -CrossTenantAccessPolicyConfigurationPartnerTenantId $SourceTenantId -BodyParameter $Params

故障描述 - 权限不足错误

尝试执行操作时，你收到如下所示的错误消息：

code: Authorization_RequestDenied
message: Insufficient privileges to complete the operation.

原因

登录用户没有足够的权限，或者你需要同意其中一个所需的权限。

解决方案

确保为你分配了所需的角色。请参阅本文前面的先决条件。
在 Microsoft Graph 浏览器工具中，确保同意所需的权限。请参阅本文前面的步骤 1：登录到目标租户和步骤 4：登录到源租户。

症状 - Request_MultipleObjectsWithSameKeyValue 错误

在尝试进行图形 API 调用时，会收到类似于以下内容的错误消息：

code: Request_MultipleObjectsWithSameKeyValue
message: Another object with the same value for property tenantId already exists.
message: A conflicting object with one or more of the specified property values is present in the directory.

原因

你可能正在试图根据以前的配置创建一个已经存在的配置或对象。

解决方案

验证请求语法以及是否使用的租户 ID 是否正确。
发出 GET 请求以列出现有对象。
如果已有现有对象，则可能需要使用 PATCH 发出更新请求，而不是使用 POST 或 PUT 发出创建请求，例如：
- 更新 crossTenantAccessPolicyConfigurationPartner
- 更新 crossTenantIdentitySyncPolicyPartner

症状 - Directory_ObjectNotFound 错误

在尝试进行图形 API 调用时，会收到类似于以下内容的错误消息：

code: Directory_ObjectNotFound
message: Unable to read the company information from the directory.

原因

你可能正在尝试使用 PATCH 更新并不存在的对象。

解决方案

验证请求语法以及是否使用的租户 ID 是否正确。
发出 GET 请求以验证对象是否不存在。
如果对象不存在，则可能需要使用 POST 或 PUT 发出创建请求，而不是使用 PATCH 发出更新请求，例如：
- 创建 identitySynchronization

使用 PowerShell 或 Microsoft Graph API 配置跨租户同步

先决条件

步骤 2：在目标租户中启用用户同步

步骤 3：在目标租户中自动兑换邀请

步骤 5：在源租户中自动兑换邀请

步骤 6：在源租户中创建配置应用程序

步骤 7：测试与目标租户的连接

步骤 8：在源租户中创建预配作业

步骤 9：保存凭据

步骤 10：将用户分配到配置

步骤 11：测试按需预配

步骤 12：启动预配作业

步骤 13：监视预配

故障排除提示

故障描述 - 权限不足错误

症状 - New-MgPolicyCrossTenantAccessPolicyPartner_Create 错误

症状 - Request_MultipleObjectsWithSameKeyValue 错误

故障描述 - 权限不足错误

症状 - Request_MultipleObjectsWithSameKeyValue 错误

症状 - Directory_ObjectNotFound 错误

后续步骤

其他资源

使用 PowerShell 或 Microsoft Graph API 配置跨租户同步

先决条件

步骤 1：登录到目标租户

步骤 2：在目标租户中启用用户同步

步骤 3：在目标租户中自动兑换邀请

步骤 4：登录到源租户

步骤 5：在源租户中自动兑换邀请

步骤 6：在源租户中创建配置应用程序

步骤 7：测试与目标租户的连接

步骤 8：在源租户中创建预配作业

步骤 9：保存凭据

步骤 10：将用户分配到配置

步骤 11：测试按需预配

步骤 12：启动预配作业

步骤 13：监视预配

故障排除提示

故障描述 - 权限不足错误

症状 - New-MgPolicyCrossTenantAccessPolicyPartner_Create 错误

症状 - Request_MultipleObjectsWithSameKeyValue 错误

后续步骤

其他资源