Adding users with roles into app registration

问题

I can see you can create app registrations with graph API but is it possible to add users and roles to an app registration?

回答1:

If you want to assign a user to that application, in one of the specified app roles, you'll need to set the appRoleAssignment on the user . If using Azure AD Graph api , you could use below rest api :

https://graph.windows.net/{tenant-id}/users/{username}/appRoleAssignments?api-version={api-version}
Content-Type:application/json
Authorization: Bearer {token}
{
    "id": "RoleID", 
    "principalId":  "UserObjectID", 
    "principalType": "User", 
    "resourceId":  "servicePrincipalID"
}

id: This is the Id for the Role you are assigning. These Ids can be found in the Application's Manifest. Or you could use below api to get the specific role defined for your application(appRoles claim):

https://graph.windows.net/{tenant}/applications/{ObjectIDOfApplication}?api-version=1.6

principalId :This is the Obeject Id of the User you are assigning the role to.

principalType :If you are assigning this role to a User then this is set to the string User .

resourceId : Service Principal ID of the application . To get service principal id , you could use below api (objectId claim) :

https://graph.windows.net/{tenant}/servicePrincipals?api-version=1.6&$filter=appId eq 'appid'

回答2:

Application role assignments are available in the Microsoft Graph Beta endpoint: see Update approleassignment

To give you an idea of what could do to add app role assignments to a user, I suggest you look at the Configure.ps1 PowerShell script of the active-directory-dotnet-webapp-roleclaims sample on GitHub, which creates test users of a given role and updates the application registration. This is in PowerShell, but you should be able to adapt it to using MSGraph

来源：https://stackoverflow.com/questions/46372230/adding-users-with-roles-into-app-registration