New-AzureADPolicy：执行 NewPolicy 时出错

Question

我正在尝试按照 Microsoft 网站 ( https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetimes ) 上的说明配置自定义令牌到期策略。

但是，我收到了一条难以理解的错误消息。这似乎不是临时错误，因为我在过去几天中尝试了几次。

我试过以正常和“管理员身份”运行 Powershell，这对结果没有影响。

PS C:\WINDOWS\system32> Connect-AzureAD -Confirm

Confirm
Are you sure you want to perform this action?
Performing the operation "Connect-AzureAD" on target "Establishing a PowerShell session connected to {0} environment.".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): A

Account                   Environment TenantId                             TenantDomain
-------                   ----------- --------                             ------------
my@example.com AzureCloud  64b6bf97-8bef-49b5-b986-6fa47c6cce08


PS C:\WINDOWS\system32> New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime”:”1.0
:00:00”,”MaxInactiveTime”:”90.00:00:00","MaxAgeMultiFactor":"365.00:00:00","MaxAgeSingleFactor”:”365.00:00:00"}}') -Dis
layName “MYTESTApps” -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
New-AzureADPolicy : Error occurred while executing NewPolicy
Code: InternalServerError
Message: Unable to resolve User Id
InnerError:
  RequestId: bbf7b26d-3cfe-493d-9eb6-cafb9606085d
  DateTimeStamp: Thu, 04 May 2017 10:25:44 GMT
HttpStatusCode: InternalServerError
HttpStatusDescription: Internal Server Error
HttpResponseStatus: Completed
At line:1 char:1
+ New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1, ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-AzureADPolicy], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.New
   Policy

PS C:\WINDOWS\system32>

Answer 1

如果您登录的用户是外部帐户（例如：xxxx@outlook.com），您将收到此错误。请使用本地 azure 广告管理员帐户 (xxxx@xxx.onmicrosoft.com) 执行New-AzureADPolicy操作。

并请更换”与"和尝试更新的命令如下：

New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"1.00:00:00","MaxInactiveTime":"90.00:00:00","MaxAgeMultiFactor":"365.00:00:00","MaxAgeSingleFactor":"365.00:00:00"}}') -DisplayName "WebPolicyScenario2" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"