Azure自動化：來自不同租戶的服務主體帳戶進行身份驗證，但不返回服務主體

Question

我在其他租戶的訂閱上執行運行手冊時遇到問題。

到目前為止，這是我所做的：

1）創建了一個密鑰庫證書。
2）導出證書的.cer和.PFX。
3）在rpgorch-aad帳戶（300eab96-4619-4b6b-af42-8eb66506ab04）上創建了服務主體
4）使用該服務主體的信息在Automation中創建一個連接
5）將受密碼保護的PFX上傳到自動化證書存儲

首先，來自同一租戶的工作示例：

    $connectionName = 'AzureRunasConnection'
"Getting Azure Connection $connectionName"
$servicePrincipalConnection = Get-AutomationConnection -Name $connectionName         
"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $servicePrincipalConnection.TenantID `
    -ApplicationId $servicePrincipalConnection.ApplicationId `
    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $servicePrincipalConnection.TenantID -SubscriptionId $servicePrincipalConnection.SubscriptionId -Verbose
"Writing Output of the Service Principal Connection"
 write-output $servicePrincipalConnection

"Testing getting resource groups."
Get-AzureRmResourceGroup

結果：

Getting Azure Connection AzureRunasConnection  
Logging in to Azure using Add-AzureRmAccount  

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}  
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext  

Setting Context with Set-AzureRmContext  
PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Account               : Redacted  
Environment           : AzureCloud  
Subscription          : Redacted  
Tenant                : Redacted  

Writing Output of the Service Principal Connection  

Name                           Value                                                                                    
----                           -----                                                                                    
SubscriptionId                 Redacted                                                     
TenantId                       Redacted                                                     
ApplicationId                  Redacted                                                     
CertificateThumbprint          Redacted                                                 


Testing getting resource groups.

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
ResourceGroupName     : Redacted  
Location              : eastus  
Resources             :   
ResourcesTable        :   
ProvisioningState     : Succeeded  
Tags                  : {}  
TagsTable             :   
ResourceId            : /subscriptions/Redacted/resourceGroups/Redacted  

現在是相同的代碼，但適用於其他租戶。

$connectionName = 'Redacted'
"Getting Azure Connection"  
$connectionName

$Conn = Get-AutomationConnection -Name $connectionName 

"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $Conn.TenantID `
    -ApplicationId $Conn.ApplicationId `
    -CertificateThumbprint $Conn.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $Conn.TenantID -SubscriptionId $Conn.SubscriptionId -Verbose

"Selecting subscriptionID "
$Conn.SubscriptionID
Select-AzureSubscription -SubscriptionId $Conn.SubscriptionID 

"Testing getting resource groups."
Get-AzureRmResourceGroup

結果：

Getting Azure Connection
RPGOrchResourceManagement

Logging in to Azure using Add-AzureRmAccount

Results: 
PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

Answer 1

我想出了答案。 對於其他用戶，我需要在Application ID上運行以下命令：

        New-AzureRMRoleAssignment -RoleDefinitionName Contributor -ServicePrincipalName $ApplicationId | Write-Verbose -ErrorAction SilentlyContinue