Microsoft 365 开发篇：如何在SPO中获取一套完整的权限变化

51CTO博客地址：https://blog.51cto.com/1396817

博客园博客地址：https://www.cnblogs.com/bxapollo

Microsoft Graph 是一个RESTful web API，可以通过它来访问Microsoft 云服务器资源，注册应用程序并获取用户或服务的身份验证令牌后，可以向Microsoft Graph API请求。

默认的情况下，Deltalinks（Token）是一个用户范围的API，可用于类似同步的行为，比如可以获取一个完整的权限枚举来验证，Delta尝试将基于权限的更改范围限定为Caller相关的更改，如果caller的访问权限没有因权限更改而改变，则该项可能不会包含在增量结果中。

获取权限的前提条件：确保遵守aca.ms/scanguidance中的建议，否则将导致获取权限更改范围的缩小。

获取权限的方法：

对sites.fullcontrol使用使用仅适用于应用程序的身份验证
所有范围和pass header “preferred"="deltashowsharingchanges.hierarchicalsharing"

实现步骤：

1. 在AAD创建一个应用程序，并且有sites.fullcontrol等如下权限

2. 采用如下powershell脚本生成access token和delta token link：

 cls 
$host.Runspace.ThreadOptions = "ReuseThread" 
Write-Host "STARTED at" (Get-Date).ToString() -f Green 
$ClientID = "fa9737d5-5a3e-4fab-0000-000000000000" 
$ClientSecret = "1JOe:M8HBBUz-0000000000000000000" 
$scope= "https://graph.microsoft.com/.default" 
$POSTURI = "https://login.microsoftonline.com/d6f932a7-5f74-0000-0000-000000000000/oauth2/v2.0/token" 
$body = @{grant_type="client_credentials";client_id=$ClientID;client_secret=$ClientSecret;scope=$scope} 
$oauth = Invoke-RestMethod -Method Post -Uri $POSTURI -Body $body $graphAccessToken = $oauth.access_token 
Write-Host "Access token: $($graphAccessToken)" 
$requestHeader = @{ 
"Authorization" = "Bearer $graphAccessToken" 
"Content-Type" = "application/json" 
"Prefer" = "deltashowsharingchanges,hierarchicalsharing,deltatraversepermissiongaps,deltashowremovedasdeleted" 
} 
$Uri = "https://graph.microsoft.com/v1.0/sites/spotenant.sharepoint.com,df6ba610-b132-0000-0000-000000000000,e0dbcdc6-0637-4246-0000-000000000000/drive/root/delta?latest" 
$Result = (Invoke-RestMethod -Method Get -Headers $requestheader -Uri $Uri) 
$deltaUri = $Result.'@odata.deltaLink' 
Write-Host $deltaUri 
Write-Host "DONE at" (Get-Date).ToString() -f Green

3. 从上面的脚本复制access token 和deltauri值输出，并在下面的示例powershell脚本中使用它们来检索完整的权限更改集。

cls 
$host.Runspace.ThreadOptions = "ReuseThread" 
Write-Host "STARTED at" (Get-Date).ToString() -f Green 
$graphAccessToken = "copied from output of above sample powershell script" $requestHeader = @{ 
"Authorization" = "Bearer $graphAccessToken" 
"Content-Type" = "application/json" 
"Prefer" = "deltashowsharingchanges,hierarchicalsharing" 
} 
Write-Host 
$deltaUri = "copied from output of above sample powershell script" #should look like sample below: https://graph.microsoft.com/v1.0/sites/spotenant.sharepoint.com,df6ba610-b132-4fc7-0000-000000000000,e0dbcdc6-0637-4246-0000-000000000000/drive/root/delta?token=MzslMjM0OyUyMzE7Mzs3NDlhZjc4NC0zOWU0LTRlOTEtYmJkNy0wNzI5MjAxNTNlMGY7NjM3MzM2NDU1MzMyNDcwMDAwOzMxOTY4OTE4MjslMjM7JTIzOyUyMzA" $deltaResult = (Invoke-RestMethod -Method Get -Headers $requestheader -Uri $deltaUri) Write-Host $deltaResult.value 
Write-Host 
Write-Host "DONE at" (Get-Date).ToString() -f Green