“同意申请”和“添加委托权限授予”有什么区别？

Question

我一直在探索 Azure Active Directory 审核日志发送到我的 SIEM，并注意到有类型为Consent to Application以及Add delegated permission grant的事件。 我不确定有什么区别 - 我认为授予应用程序同意就是授予它委派权限？

作为一个具体的例子，这里有两个这样的事件同时为同一个用户触发（四舍五入到一秒），具有相同的correlationId - 所以推测它们是作为同一“流”的一部分发生的。 我删除了一些不相关的字段，还标记了 GUID 等。

这是Consent to Application事件：

{
    "Actor": [
        {"ID": "name@corp.com", "Type": 5},
        {"ID": "Actor_PUID" "Type": 3},
        {"ID": "User_guid_user", "Type": 2},
        {"ID": "guid_user", "Type": 2},
        {"ID": "User", "Type": 2}
    ],
    "ActorContextId": "guid_actor_context_id",
    "AzureActiveDirectoryEventType": 1,
    "CreationTime": "2020-04-28T11:51:30",
    "ExtendedProperties": [
        {"Name": "actorContextId", "Value": "guid_actor_context_id"},
        {"Name": "actorObjectId", "Value": "guid_user"},
        {"Name": "actorObjectClass", "Value": "User"},
        {"Name": "actorUPN", "Value": "name@corp.com"},
        {"Name": "actorPUID", "Value": "Actor_PUID"},
        {"Name": "targetContextId", "Value": "guid_actor_context_id"},
        {"Name": "targetObjectId", "Value": "guid_target_object"},
        {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"},
        {"Name": "targetSPN", "Value": "guid_target_spn"},
        {"Name": "targetName", "Value": "App Name"},
        {
            "Name": "targetIncludedUpdatedProperties",
            "Value": "[\"ConsentContext.IsAdminConsent\",\"ConsentContext.IsAppOnly\",\"ConsentContext.OnBehalfOfAll\",\"ConsentContext.Tags\",\"ConsentAction.Permissions\",\"TargetId.ServicePrincipalNames\"]"
        }
    ],
    "Id": "guid_id",
    "ModifiedProperties": [
        {
            "Name": "ConsentAction.Permissions",
            "NewValue": "[] => [[Id: XXX, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: guid_user, ResourceId: guid_resource_id, ConsentType: Principal, Scope:  openid offline_access Calendars.ReadWrite]]; ",
            "OldValue": ""
        },
        {"Name": "TargetId.ServicePrincipalNames", "NewValue": "guid_target_spn", "OldValue": ""}
    ],
    "ObjectId": "guid_target_spn",
    "Operation": "Consent to application.",
    "RecordType": 8,
    "ResultStatus": "Success",
    "Target": [
        {"ID": "ServicePrincipal_guid_target_object", "Type": 2},
        {"ID": "guid_target_object", "Type": 2},
        {"ID": "ServicePrincipal", "Type": 2},
        {"ID": "App Name", "Type": 1},
        {"ID": "guid_target_spn", "Type": 2},
        {ID": "guid_target_spn", "Type": 4}
    ],
    "TargetContextId": "guid_actor_context_id",
}

这大概意味着具有 object ID guid_user （和相同的主体 ID）的用户授予具有服务主体guid_target_spn权限的App Name ，以访问具有委派权限openid offline_access Calendars.ReadWrite的资源guid_resource_id 。

现在，这是Add delegated permission grant ：

{
    "Actor": [
        {"ID": "user@corp.com", "Type": 5},
        {"ID": "user_puid", "Type": 3},
        {"ID": "User_user_guid", "Type": 2},
        {"ID": "user_guid", "Type": 2},
        {"ID": "User", "Type": 2}
    ],
    "ActorContextId": "guid_actor_context_id",
    "CreationTime": "2020-04-28T11:51:30",
    "ExtendedProperties": [
        {"Name": "actorContextId", "Value": "guid_actor_context_id"},
        {"Name": "actorObjectId", "Value": "user_guid"},
        {"Name": "actorObjectClass", "Value": "User"},
        {"Name": "actorUPN", "Value": "user@corp.com"},
        {"Name": "actorPUID", "Value": "user_puid"},
        {"Name": "targetContextId", "Value": "guid_actor_context_id"},
        {"Name": "targetObjectId", "Value": "guid_resource_id"},
        {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"},
        {
            "Name": "targetSPN",
            "Value": "https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000;Microsoft.Azure.AgregatorService"
        },
        {"Name": "targetName", "Value": "Microsoft Graph"},
        {
            "Name": "targetIncludedUpdatedProperties",
            "Value": "[\"ServicePrincipal.ObjectID\",\"ServicePrincipal.DisplayName\",\"ServicePrincipal.AppId\",\"ServicePrincipal.Name\",\"TargetId.ServicePrincipalNames\"]"
        },
        {
            "Name": "additionalTargets",
            "Value": "[{\"ObjectID\":\"guid_target_object\",\"DisplayName\":null,\"ObjectClass\":\"ServicePrincipal\",\"AppId\":null,\"Name\":null}]"
        },
    ],
    "ModifiedProperties": [
        {"Name": "ServicePrincipal.ObjectID", "NewValue": "guid_target_object", "OldValue": ""},
        {"Name": "ServicePrincipal.DisplayName", "NewValue": "", "OldValue": ""},
        {"Name": "ServicePrincipal.AppId", "NewValue": "", "OldValue": ""},
        {"Name": "ServicePrincipal.Name", "NewValue": "", "OldValue": ""},
        {
            "Name": "TargetId.ServicePrincipalNames",
            "NewValue": "https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000;Microsoft.Azure.AgregatorService",
            "OldValue": ""
        }
    ],
    "ObjectId": "https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000;Microsoft.Azure.AgregatorService",
    "Operation": "Add delegated permission grant.",
    "OrganizationId": "guid_actor_context_id",
    "RecordType": 8,
    "ResultStatus": "Success",
    "SupportTicketId": "",
    "Target": [
        {"ID": "ServicePrincipal_guid_resource_id", "Type": 2},
        {"ID": "guid_resource_id", "Type": 2},
        {"ID": "ServicePrincipal", "Type": 2},
        {"ID": "Microsoft Graph", "Type": 1},
        {"ID": "00000003-0000-0000-c000-000000000000", "Type": 2},
        {
            "ID": "https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000;Microsoft.Azure.AgregatorService",
            "Type": 4
        }
    ],
    "TargetContextId": "guid_actor_context_id",
    "UserId": "user@corp.com",
    "UserKey": "user_puid@corp.com",
}

我试图弄明白这一切。 具体来说 -

1）第二个事件是什么意思？ 为什么它说它是关于授权许可，但没有提到该许可是什么？ 显然，这与第一次调用相同的资源 ID 相关，但以什么方式？ 它是否授予Microsoft Graph对同一资源的访问权限（如果是，在哪些权限下）？

2) 在第一次调用中， guid_target_object是什么？ 它代表应用程序ID吗？ 如果是这样，为什么它显示为ServicePrincipal_guid_target_object ？

Answer 1

您可以在门户中找到审核日志导航到企业应用程序 -> 审核日志。

当您添加委派权限（例如 Microsoft Graph -> 委派权限）然后单击按钮grant admin consent for xxx ，将发送这四个审核日志：

你提到的两个电话同时发生。 添加委托权限授予的目标是 Microsoft Graph 和添加权限的应用程序。 同意 application的目标只是应用程序。 它们是一个过程中的两个步骤。

更新：

从我的测试结果来看， add a delegated permission只是发送更新应用程序和更新服务主体。 您提到的两个日志是在单击按钮时发送的（授予 xxx 管理员同意），它们是同时发送的。 这是由微软决定的。

如果您想知道权限，可以在update application -> Modified Properties中找到它们。

id 是 Microsoft graph 中权限的resource id ：

您可以通过 Powershell 获取权限值：

(Get-AzureADServicePrincipal -ObjectId <object-id of the MS Graph in your tenant>).Oauth2Permissions | Where-Object {$_.Id -eq '570282fd-fa5c-430d-a7fd-fc8dc98a9dca'}