microsoft-graph-api - 使用第一方应用程序调用 Microsoft Graph API 失败，权限不足，无法完成对“SubscribedSkus API”的操作

Question

调用 microsoft graph API https://graph.microsoft.com/v1.0/subscribedSkus失败，出现
“code”：“Authorization_RequestDenied”，“message”：“Insufficient rights to complete the operation.”，如果我们创建一个租户中非管理员的新用户。但是在使用管理员用户调用它时它工作得很好。即使它适用于租户中的任何微软用户。

这是我曾经尝试过的以下代码。

public static async Task TestAadGraph()
    {
        // using obo token of the user.
        var graphToken = await GetTokenAsync(UserId, Token, "https://graph.microsoft.com");

        var aadGraphClient = new AadGraphClient(new HttpClient());

        var licenseResponse = await aadGraphClient.GetTenantLicenseDetailAsync(graphToken);
        foreach (var license in licenseResponse)
        {
            Console.WriteLine("Sku ID: {0}", license.SkuId);
            Console.WriteLine("Sku Part Number: {0}", license.SkuPartNumber);

            foreach (var plan in license.ServicePlans)
            {
                Console.WriteLine("Plan Id: {0}", plan.ServicePlanId);
                Console.WriteLine("Plan Name: {0}", plan.ServicePlanName);
            }
        }
    }

 public async Task<SubscribedSku[]> GetTenantLicenseDetailAsync(string accessToken)
    {
        var request = new RequestMessage
        {
            BearerToken = accessToken,
            Endpoint = new Uri("http://graph.microsoft.com/v1.0/subscribedSkus"),
        };

        var response = await _httpClient.FetchAsync<SubscribedSkusResponse>(request);

        return response.Value;
    }

   public static async Task<T> FetchAsync<T>(this HttpClient httpClient, RequestMessage request, Action<HttpResponseMessage, string> responseCallback) where T : class
    {
        request.Method = request.Method ?? HttpMethod.Get;
        request.MediaType = request.MediaType ?? "application/json";

        using (HttpRequestMessage message = new HttpRequestMessage(request.Method, 
            UrlHelper.AppendParameters(request.Params, request.Endpoint)))
        {
            if (!string.IsNullOrEmpty(request.BearerToken))
            {
                message.Headers.Authorization = new AuthenticationHeaderValue("Bearer", 
                request.BearerToken);
            }

            if (request.Headers != null)
            {
                foreach (KeyValuePair<string, string> header in request.Headers)
                {
                    message.Headers.Add(header.Key, header.Value);
                }
            }

            if (!string.IsNullOrEmpty(request.Content))
            {
                message.Content = new StringContent(request.Content, Encoding.UTF8, 
                request.MediaType);
            }`

            using (HttpResponseMessage response = await httpClient.SendAsync(message))
            {
                string json = await response.Content.ReadAsStringAsync();

                if (responseCallback != null)
                {
                    responseCallback?.Invoke(response, json);
                }

                if (response.IsSuccessStatusCode)
                {
                    if (predictor != null)
                    {
                        json = predictor(JToken.Parse(json)).ToString();
                    }

                    return JsonConvert.DeserializeObject<T>(json);
                }
                else
                {
                    throw new WebRequestException(response, json);
                }
            }
        }
    }

标签： microsoft-graph-apiazure-ad-graph-api

Answer 1

首先，在Microsoft Graph Explorer中尝试对新创建的用户进行相同的调用，以查看是否存在相同的场景。如果没有，则表示新用户没有任何问题。

然后调试你的代码并将graphToken复制到https://jwt.io/，看看Decoded结果是否具有所需的Delegated权限之一：<code>Organization.Read.All、Directory.Read.All、Organization.ReadWrite。全部，Directory.ReadWrite.All，Directory.AccessAsUser.All。请注意，“upn”应该是新创建用户的用户名。

如果所需的权限不存在，则需要在 Azure AD 应用程序中分配权限。请参阅API 权限。