Azure AD PowerShell：授予同意失败，错误：申请要求无效或已过时的权限

Question

我正在尝试创建一个具有应用程序和为O365 API设置的Application和委派权限的Azure Ad应用程序。该脚本运行良好，但是当我尝试从Azure Portal授予同意时。它显示以下错误：

授予同意失败，错误：应用程序'5A61FF93-7076-44A7-980F-D40DEF08EEE9B'请求无效或过时的权限。 [WYVZL7HZM8VOZFL0SV4KCF]

权限指南是正确的。实际上，问题是设置应用程序类型权限。可以授予委托/OAuth2权限，而无需任何错误。

如您所见，设置了权限（应用程序和委派：

但是，在授予同意后，我会看到以下错误：

# This script creates a new Azure AD application 
and sets the Application and Delegated permissions for specific API (O365)

$Connection = Connect-AzureAD

$CurrentDateTime = Get-Date -UFormat "%Y-%m-%d_%H-%m-%S"
$ApplicationDisplayName = "Splunk Office 365 App_" +$CurrentDateTime
#  Get the service principal for O365 and Microsoft Graph
$ServicePrincipalO365API        = Get-AzureADServicePrincipal -All $true | ? { $_.DisplayName -eq "Office 365 Management APIs" }

# Get all application permissions for O365 API
$ServicePrincipalO365APIAppRoles = $ServicePrincipalO365API.AppRoles | Where-Object {$_.Value -match "\bActivityReports.Read\b|\bActivityFeed.ReadDlp\b|\bServiceHealth.Read\b"}

# Get all delegated permissions for O365 API
$ServicePrincipalO365APIDelegatedRoles = $ServicePrincipalO365API.Oauth2Permissions | Where-Object {$_.Value -match "\bActivityReports.Read\b|\bActivityFeed.ReadDlp\b|\bServiceHealth.Read\b"}

# Create a Required Resource Access object for Office 365
$RequiredResourceAccessO365API = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$RequiredResourceAccessO365API.ResourceAppId = $ServicePrincipalO365API.AppId

$ServicePrincipalO365APIAppRolesSelectedPermissions = @()


# Get all the Resource Access objects for the Application permissions
foreach ($ServicePrincipalO365APIAppRole in $ServicePrincipalO365APIAppRoles)
{
    $Permission = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $ServicePrincipalO365APIAppRole.Id,"Role"
    $ServicePrincipalO365APIAppRolesSelectedPermissions += $Permission
}


# Get all the Resource Access objects for the Delegated permissions
foreach ($ServicePrincipalO365APIDelegatedRole in $ServicePrincipalO365APIDelegatedRoles)
{
    $Permission = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $ServicePrincipalO365APIDelegatedRole.Id,"Scope"
    $ServicePrincipalO365APIAppRolesSelectedPermissions += $Permission

}

# Assign all the permissions to the required Resource access for the O365 API 
$RequiredResourceAccessO365API.ResourceAccess  = $ServicePrincipalO365APIAppRolesSelectedPermissions

# Create the Password credential for the new app
Add-Type -AssemblyName System.Web
$ApplicationPassword =[System.Web.Security.Membership]::GeneratePassword(32,2)
$ApplicationPassword = $ApplicationPassword.Replace("+","_")
$ApplicationPassword = $ApplicationPassword.Replace("-","_")
$keyId = (New-Guid).ToString();
$fromDate = [System.DateTime]::Now
$durationInYears = 5
$endDate = $fromDate.AddYears($durationInYears) 
$Applicationkey = New-Object Microsoft.Open.AzureAD.Model.PasswordCredential($null, $endDate, $keyId, $fromDate, $ApplicationPassword)

# Create the new app with the password cred
$aadApplication = New-AzureADApplication -DisplayName $ApplicationDisplayName -PasswordCredentials $Applicationkey

write-output("Application created")

# Set the permissions
Set-AzureADApplication -ObjectId $aadApplication.ObjectId -RequiredResourceAccess $RequiredResourceAccessO365API
write-output("Application permissions set")

我将应用程序权限添加到列表中，并分配给类型“ microsoft.open.open 。

​

​

https://learn.microsoft.com/en-us/dotnetnet/dotnet/dotnet/api/api/api/microsoft.azure.azure.azure.azure.graph.raph.rbac。 fluent.models.requiredresourceaccess.resourceaccess？view = azure-dotnet＃microsoft-azure-azure-management-graph-rbac-fluent-models-requiredRequiredResoureceiredResourceaccees-ResourceAcceS-Resourceaccess

那么，如何将应用程序允许添加到它？这是为什么我不能同意申请权限吗？ 还有其他选择吗？

Answer 1

我试图在环境中复制相同的错误。我创建了一个Azure AD应用程序，并使用您的PowerShell脚本授予相同的权限。

我在尝试授予管理员同意时遇到了同样的错误：

activityReports.read API许可用于阅读组织的活动报告。

在添加此权限之前，您需要启用Office365 中的审核日志。
检查该权限是否已启用下面的启用：

https://i.sstatic.net/z2pq4.png“ alt =”在此处输入映像说明“>

如果您尝试授予管理员同意而不启用此事，则会遇到该错误。

我尝试删除 activityReports.read 许可（申请和授权），并成功地授予管理员同意：

代码> activityReports.read 权限，打开Office365的审核日志后添加它。

知道如何详细启用该选项，使用以下链接：

打开或关闭审计-Microsoft Purview | Microsoft Docs

如何启用和配置Office 365记录，审核，审核和配置 - YouTube