显示分配到应用程序代理应用程序的用户和组
该 PowerShell 脚本示例列出了分配给特定 Microsoft Entra 应用程序代理应用程序的用户和组。
如果没有 Azure 订阅,请在开始之前创建一个 Azure 免费帐户。
注意
建议使用 Azure Az PowerShell 模块与 Azure 交互。 请参阅安装 Azure PowerShell 以开始使用。 若要了解如何迁移到 Az PowerShell 模块,请参阅 将 Azure PowerShell 从 AzureRM 迁移到 Az。
此示例需要 Microsoft Graph Beta PowerShell 模块 2.10 或更高版本。
示例脚本
# This sample script displays users and groups assigned to the specified Microsoft Entra application proxy application.
#
# .\display-users-group-of-an-app.ps1 -ObjectId <ObjectId of the service principal> (Enterprise App)
#
# Version 1.0
#
# This script requires PowerShell 5.1 (x64) or beyond and one of the following modules:
#
# Microsoft.Graph.Beta ver 2.10 or newer
#
# Before you begin:
#
# Required Microsoft Entra role: Global Administrator or Application Administrator
# or appropriate custom permissions as documented https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-enterprise-app-permissions
#
#
param(
[parameter(Mandatory=$true)]
[string] $ObjectId = "null"
)
$aadapServPrincObjId=$ObjectId
If ($aadapServPrincObjId -eq "null") {
Write-Host "Parameter is missing." -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host " "
Write-Host ".\display-users-group-of-an-app.ps1 -ObjectId <ObjectId of the service principal (Enterprise App)>" -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host " "
Exit
}
Import-Module Microsoft.Graph.Beta.Applications
Connect-MgGraph -Scope Directory.Read.All -NoWelcome
Write-Host "Reading users. This operation might take longer..." -BackgroundColor "Black" -ForegroundColor "Green"
$users= Get-MgBetaUser -Top 1000000
Write-Host "Reading groups. This operation might take longer..." -BackgroundColor "Black" -ForegroundColor "Green"
$groups = Get-MgBetaGroup -Top 1000000
try {$app = Get-MgBetaServicePrincipalById -Id $aadapServPrincObjId}
catch {
Write-Host "Possibly the ObjetId is incorrect." -BackgroundColor "Black" -ForegroundColor "Red"
Write-Host " "
Exit
}
Write-Host ("Application: " + $app.DisplayName + "(ServicePrinc. ObjID:" + $aadapServPrincObjId + ")")
Write-Host ("")
Write-Host ("Assigned (directly and through group membership) users:")
Write-Host ("")
$number=0
foreach ($item in $users) {
$listOfAssignments = Get-MgBetaUserAppRoleAssignment -UserId $item.Id
$assigned = $false
foreach ($item2 in $listOfAssignments) { if ($item2.ResourceId -eq $aadapServPrincObjId) { $assigned = $true } }
If ($assigned -eq $true) {
Write-Host ("DisplayName: " + $item.DisplayName + " UPN: " + $item.UserPrincipalName + " ObjectID: " + $item.Id)
$number = $number + 1
}
}
Write-Host ("")
Write-Host ("Number of (directly and through group membership) users: " + $number)
Write-Host ("")
Write-Host ("")
Write-Host ("Assigned groups:")
Write-Host ("")
$number=0
foreach ($item in $groups) {
$listOfAssignments = Get-MgBetaGroupAppRoleAssignment -GroupId $item.Id
$assigned = $false
foreach ($item2 in $listOfAssignments) { If ($item2.ResourceID -eq $aadapServPrincObjId) { $assigned = $true } }
If ($assigned -eq $true) {
Write-Host ("DisplayName: " + $item.DisplayName + " ObjectID: " + $item.Id)
$number=$number+1
}
}
Write-Host ("")
Write-Host ("Number of assigned groups: " + $number)
Write-Host ("")
Write-Host ("")
Write-Host ("Finished.") -BackgroundColor "Black" -ForegroundColor "Green"
Write-Host ("")
Write-Host "To disconnect from Microsoft Graph, please use the Disconnect-MgGraph cmdlet."
脚本说明
Command | 说明 |
---|---|
Connect-MgGraph | 连接到 Microsoft Graph |
Get-MgBetaServicePrincipalById | 通过 ID 获取服务主体 |
Get-MgBetaUser | 获取用户 |
Get-MgBetaGroup | 获取组 |
Get-MgBetaUserAppRoleAssignment | 获取应用程序角色分配 |