Azure：可以将委托的API权限分配给托管身份吗？
我正在测试Azure中的托管身份。我的情况是，我需要代表系统或用户分配的MID访问Microsoft图。基于auf docs i 能够配置它们中的每一个并分配Graph API权限。我看到它们都是应用程序权限（MID -＆GT;设置菜单 - ＆GT; Security-permissions）。我期望这是针对系统分配的中间的，但没有用户分配的中间。我想让它访问API槽的原因是某些图形API权限受到保护，并且无法在应用程序上下文中访问，例如ChanneMessage.Ald.All（读取团队频道消息）。
因此，我的问题基本上是：是否有人知道是否有一种方法可以在具有托管身份的非应用上下文中访问受保护的图形API。如果您需要特定的详细信息，请让我知道。
I was testing managed identities in Azure. My scenario is I need to access the Microsoft Graph on behalf of either a system- or user-assigned MID. On the basis auf the docs I
was able to configure each one of them and assign Graph API permissions. I see that they're all application permissions (MID -> Settings menu -> Security -> Permissions). I expected this for the system-assigned MID but not for the user-assigned MID. The reason I want to have it access the API trough the delegated type is that some Graph API permissions are protected and cannot be accesses in an application context, such as ChannelMessage.Read.All (read Teams channel messages).
So my question is basically: Does anybody know if there's a way to access protected Graph API's in a non-application context with a managed identity. Please let me know if you need specific details.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
据我所知，这是不可能的。
托管身份只能利用应用程序权限。
从理论上讲，您可以将授权的许可分配给其服务原则，但您将无法作为具有托管身份的用户登录。
“用户分配”托管身份只是单独的Azure资源，而不是成为另一个资源的一部分。它们与Azure AD中的系统分配没有什么不同，两者都是服务主体。
As far as I know, it is not possible.
Managed Identities can only utilize application permissions.
While in theory you could assign a delegated permission to its service principal, you would not be able to sign in as a user with the Managed Identity.
"User-assigned" Managed Identities are just a separate Azure resource instead of being part of another resource. They are not different from system-assigned in Azure AD, both are service principals.