创建代理标识蓝图

此步骤创建代理标识蓝图，分配所有者和发起人，并需要以下详细信息：

• AgentIdentityBlueprint.Create 权限。
• OData-Version 标头必须设置为 4.0。
• 示例请求正文中所有者和发起方字段的用户 ID。 需要发起人，但所有者是可选的。

POST https://microsoftgraph.chinacloudapi.cn/v1.0/applications/
OData-Version: 4.0
Content-Type: application/json
Authorization: Bearer <token>

{
  "@odata.type": "Microsoft.Graph.AgentIdentityBlueprint",
  "displayName": "My Agent Identity Blueprint",
  "sponsors@odata.bind": [
    "https://microsoftgraph.chinacloudapi.cn/v1.0/users/<id>"
  ],
  "owners@odata.bind": [
    "https://microsoftgraph.chinacloudapi.cn/v1.0/users/<id>"
  ]
}

创建代理标识蓝图后，记录 appId 的值以用于下一步。

此步骤使用当前用户作为所有者和发起人创建代理标识蓝图应用程序，并包含以下不同的任务：

• 使用AgentIdentityBlueprint.Create和User.Read作用域连接到你的租户。
• 将当前用户添加为代理标识蓝图的发起者和所有者。
• 创建代理标识蓝图应用程序。

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "AgentIdentityBlueprint.Create","User.Read"

$currentUser = Get-MgContext | Select-Object -ExpandProperty Account
$user = Get-MgUser -UserId $currentUser

Write-Host "Current user: $($user.DisplayName) ($($user.Id))"
Write-Host "Sponsor user: $($user.DisplayName) ($($user.Id))"


$body = @{
    "@odata.type" = "Microsoft.Graph.AgentIdentityBlueprint"
    "displayName" = "My Agent Identity Blueprint"
    "sponsors@odata.bind" = @("https://microsoftgraph.chinacloudapi.cn/v1.0/users/$($user.Id)")
    "owners@odata.bind" = @("https://microsoftgraph.chinacloudapi.cn/v1.0/users/$($user.Id)")
} | ConvertTo-Json -Depth 5

$response = Invoke-MgGraphRequest `
    -Method POST `
    -Uri "https://microsoftgraph.chinacloudapi.cn/v1.0/applications/microsoft.graph.agentIdentityBlueprint" `
    -Headers @{ "OData-Version" = "4.0" } `
    -Body $body `
    -ContentType "application/json"

$response

创建代理标识蓝图后，记录输出中的值 appId 。

若要发送此请求，请执行下列步骤：

• 你需要 AgentIdentityBlueprint.AddRemoveCreds.All 权限。
• 将 <agent-blueprint-id> 占位符替换为 appId 代理标识蓝图。
• 将 <managed-identity-principal-id> 占位符替换为托管身份的 ID。

使用以下请求将托管身份添加为凭据：

POST https://microsoftgraph.chinacloudapi.cn/v1.0/applications/<agent-blueprint-id>/federatedIdentityCredentials
OData-Version: 4.0
Content-Type: application/json
Authorization: Bearer <token>

{
    "name": "my-managed-identity",
    "issuer": "https://login.partner.microsoftonline.cn/<your-tenant-id>/v2.0",
    "subject": "<managed-identity-principal-id>",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

此步骤包括以下不同的任务：

• 使用 AgentIdentityBlueprint.AddRemoveCreds.All 范围连接到租户。
• 使用先前创建的代理标识蓝图主体，将托管标识作为凭据添加到代理标识蓝图中。

Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "AgentIdentityBlueprint.AddRemoveCreds.All"

$applicationId = "<agent-blueprint-id>"

$federatedCredential = @{
  Name             = "my-managed-identity"
  Issuer           = "https://login.partner.microsoftonline.cn/<your-tenant-id>/v2.0"
  Subject          = "<managed-identity-principal-id>"
  Audiences         = @("api://AzureADTokenExchange")
}

New-MgApplicationFederatedIdentityCredential `
  -ApplicationId $applicationId `
  -BodyParameter $federatedCredential

若要发送此请求，首先需要获取具有委派权限的访问令牌 AgentIdentityBlueprint.AddRemoveCreds.All

POST https://microsoftgraph.chinacloudapi.cn/v1.0/applications/<agent-blueprint-id>/addPassword
Content-Type: application/json
Authorization: Bearer <token>

{
  "passwordCredential": {
    "displayName": "My Secret",
    "endDateTime": "2026-08-05T23:59:59Z"
  }
}

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "AgentIdentityBlueprint.AddRemoveCreds.All"

$applicationId = "<agent-blueprint-application-id>"

# Define the secret properties
$displayName = "My Secret"
$endDate = (Get-Date).AddYears(1).ToString("o")  # 1 year from now, in ISO 8601 format

# Construct the password credential
$passwordCredential = @{
    displayName = $displayName
    endDateTime = $endDate
}

# Add the password (client secret)
$response = Add-MgApplicationPassword -ApplicationId $applicationId -PasswordCredential $passwordCredential

# Output the generated secret (only returned once!)
Write-Host "Secret Text: $($response.secretText)"

若要发送此请求，请执行下列步骤：

• 需要权限 AgentIdentityBlueprint.UpdateAuthProperties.All。
• 将 <agent-blueprint-id> 占位符替换为 appId 代理标识蓝图。
• 需要全局唯一标识符（GUID）。 在 PowerShell 中，运行 [guid]::NewGuid() 或使用联机 GUID 生成器。 复制生成的 GUID 并将其用于替换 <generate-a-guid> 占位符。

PATCH https://microsoftgraph.chinacloudapi.cn/v1.0/applications/<agent-blueprint-id>
OData-Version: 4.0
Content-Type: application/json
Authorization: Bearer <token>

{
    "identifierUris": ["api://<agent-blueprint-id>"],
    "api": {
      "oauth2PermissionScopes": [
        {
          "adminConsentDescription": "Allow the application to access the agent on behalf of the signed-in user.",
          "adminConsentDisplayName": "Access agent",
          "id": "<generate-a-guid>",
          "isEnabled": true,
          "type": "User",
          "value": "access_agent"
        }
      ]
  }
}

成功的调用生成 204 响应。

此步骤包括以下不同的任务：

• 安装所需的模块（如果尚未安装）。
• 使用 AgentIdentityBlueprint.UpdateAuthProperties.All 范围连接到租户。
• 配置新代理身份蓝图的 URI 和作用域。

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "AgentIdentityBlueprint.UpdateAuthProperties.All"

$AppId = "<agent-blueprint-id>"
$IdentifierUri = "api://<agent-blueprint-id>"
$ScopeId = [guid]::NewGuid()

# Construct the OAuth2 permission scope
$scope = @{
    adminConsentDescription = "Allow the application to access the agent on behalf of the signed-in user."
    adminConsentDisplayName = "Access agent"
    id = $ScopeId
    isEnabled = $true
    type = "User"
    value = "access_agent"
}

Update-MgApplication -ApplicationId $AppId `
    -IdentifierUris @($IdentifierUri) `
    -Api @{ oauth2PermissionScopes = @($scope) }

将从上一步的结果中复制的 <agent-blueprint-app-id> 占位符替换为 appId 占位符。

POST https://microsoftgraph.chinacloudapi.cn/v1.0/serviceprincipals/microsoft.graph.agentIdentityBlueprintPrincipal
OData-Version: 4.0
Content-Type: application/json
Authorization: Bearer <token>

{
  "appId": "<agent-blueprint-app-id>"
}

创建代理标识蓝图后，使用新创建的代理标识蓝图创建代理标识蓝图 appId主体。

Connect-MgGraph -Environment 中国 -ClientId“YOUR_CLIENT_ID”-TenantId“YOUR_TENANT_ID”-Scopes“AgentIdentityBlueprintPrincipal.Create”。

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "AgentIdentityBlueprintPrincipal.Create"
$body = @{
    appId   = "<agent-blueprint-client-id>"
}
Invoke-MgGraphRequest -Method POST `
        -Uri "https://microsoftgraph.chinacloudapi.cn/v1.0/serviceprincipals/microsoft.graph.agentIdentityBlueprintPrincipal" `
        -Headers @{ "OData-Version" = "4.0" } `
        -Body ($body | ConvertTo-Json)