SharePoint Online：使用 PowerShell 从 Azure AD 同步用户配置文件属性

要求：使用 PowerShell 将用户配置文件属性从 Azure Active Directory 同步到 SharePoint Online。

如何在 SharePoint Online 中同步用户配置文件属性？

在典型的 SharePoint Online 环境中，用户配置文件同步过程将用户配置文件从本地 AD 导入到 Azure（通过 AD 同步工具），然后从 Azure Active Directory (AAD) 映射某些属性并与 SharePoint Online 同步用户档案。并非 Azure AD 中的所有属性都会同步到 SharePoint Online。我需要将“手机”属性同步到 SharePoint Online 用户配置文件。尽管 Azure AD 同步工具从本地 AD 导入“移动”属性，但 SharePoint 没有此属性的映射！

坏消息是：目前，无法从 SharePoint Online 管理页面映射和同步其他属性（就像我们在 SharePoint On-Premises 中所做的那样）。但是，我们可以循环访问 Azure AD 中的用户，并使用 CSOM PowerShell 脚本更新 SharePoint Online 中的用户配置文件属性。

用于在 SharePoint Online 中导入用户配置文件属性的 PowerShell：

使用 Azure AD PowerShell 和 SharePoint 客户端对象模型 (CSOM)，我们可以从 Azure AD 获取用户配置文件属性值并更新 SharePoint Online 用户配置文件中的相应属性，然后安排此脚本定期运行。让我们使用 PowerShell 将手机从 Azure Active Directory 同步到 SharePoint Online。

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\ISAPI\Microsoft.SharePoint.Client.UserProfiles.dll"

Function Sync-UserProfileProperty()
{
    Param
    (
        [Parameter(Mandatory=$true)] [string] $AdminSiteUrl,
        [Parameter(Mandatory=$true)] [string] $UserPrincipalName,
        [Parameter(Mandatory=$true)] [string] $ADPropertyName,
        [Parameter(Mandatory=$true)] [string] $SPOPropertyName
    )
    #Get Credentials to connect
    $Cred = Get-Credential
 
    Try {
        #Connect to AzureAD
        Connect-AzureAD -Credential $Cred | Out-Null
 
        #Get the User Property from AzureAD
        $AzureADUser = Get-AzureADUser -ObjectId $UserPrincipalName
        $ADUserPropertyValue = $AzureADUser | Select -ExpandProperty $ADPropertyName
        #To get extended property value, use: $AzureADUser.ExtensionProperty.Item($ADPropertyName)

        #Setup the context
        $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($AdminSiteUrl)
        $Ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.Username, $Cred.Password)
  
        #Get User Profile Manager
        $PeopleManager = New-Object Microsoft.SharePoint.Client.UserProfiles.PeopleManager($Ctx)
  
        #Sync User Profile Property from AD
        $UserAccount = "i:0#.f|membership|$UserPrincipalName"
        $PeopleManager.SetSingleValueProfileProperty($UserAccount, $SPOPropertyName, $ADUserPropertyValue)
        $Ctx.ExecuteQuery()
        Write-host "User Profile Property has been Synched for: $UserPrincipalName" -f Green 
    }
    Catch {
        write-host -f Red "Error Synching User Profile Property!" $_.Exception.Message
    }
}
#Config parameters
$AdminSiteUrl = "https://crecent-admin.sharepoint.com"
$UserPrincipalName = "[email protected]"
$ADPropertyName = "MobilePhone"
$SPOPropertyName = "CellPhone"

#Call the function to sync a Property from Azure AD to SharePoint Online
Sync-UserProfileProperty -AdminSiteUrl $AdminSiteURL -UserPrincipalName $UserPrincipalName -ADPropertyName $ADPropertyName -SPOPropertyName $SPOPropertyName

此 PowerShell 脚本将特定用户的给定属性从 Azure AD 导入到 SharePoint Online。在运行此脚本之前，请确保您的计算机中安装了 Azure AD 模块：

Install-Module AzureAD

PowerShell 同步所有用户的用户配置文件属性值

这次，我们使用 PnP PowerShell 将所有用户的用户配置文件属性从 Azure AD 同步到 SharePoint Online。另外，我们检查以下内容：

1. 如果 AD 用户配置文件属性具有某个值（不为空！）
2. 如果 SharePoint Online 中的用户配置文件属性没有任何现有值！

#Config Variables
$AdminSiteURL = "https://crescent-admin.sharepoint.com"
$ADPropertyName = "Department"
$SPOPropertyName = "Department"

#Get Credentials to connect to Azure AD and SharePoint Online Admin Center
$Cred = Get-Credential

Try {
    #Connect to AzureAD
    Connect-AzureAD -Credential $Cred | Out-Null

    #Get All Users of the Domain from AzureAD 
    $AllUsers = Get-AzureADUser -All:$True -Filter "UserType eq 'Member'" 
    Write-host "Total Number of User Profiles Found:"$AllUsers.Count  

    #Connect to PnP Online
    Connect-PnPOnline -Url $AdminSiteURL -Credentials $Cred

    #Iterate through All Users
    $Counter = 1
    ForEach($User in $AllUsers)
    {
        Write-host "`nUpdating User Profile Property for: $($User.UserPrincipalName)" -f Yellow

        #Get the User Property value from Azure AD        
        $ADUserPropertyValue = $User | Select -ExpandProperty $ADPropertyName

        #Check if the AD Property is not Null
        If (!([string]::IsNullOrEmpty($ADUserPropertyValue))) 
        {
            #Get existing User Profile Property from SharePoint
            $UserAccount = "i:0#.f|membership|$($User.UserPrincipalName)"
            $UserProfile = Get-PnPUserProfileProperty -Account $UserAccount
            $UserProfileProperty = $UserProfile.UserProfileProperties[$SPOPropertyName]

            #Check if the Existing SharePoint User Profile Property is Null
            If (([string]::IsNullOrEmpty($UserProfileProperty))) 
            {
                Set-PnPUserProfileProperty -Account $UserAccount -PropertyName $SPOPropertyName -Value $ADUserPropertyValue
                Write-host "`tUpdated User Profile Property for: $($User.UserPrincipalName)" -f Green
            }
            Else
            {
                Write-host "`t Existing Value of the Property in SharePoint is Not Null! Skipping..." -f Yellow
            }
        }
        else
        {
            Write-host "`t AD Value of the Property is Null! Skipping..." -f Yellow
        }
        $Counter++
        Write-Progress -Activity "Updating User Profile Data..." -Status "Updating User Profile $Counter of $($AllUsers.Count)" -PercentComplete (($Counter / $AllUsers.Count)  * 100)
    }
}
Catch {
    write-host -f Red "Error Updating User Profile Property!" $_.Exception.Message
}

SharePoint Online 中的默认用户配置文件属性映射

以下是从 Azure AD 映射并同步到 SharePoint Online 的用户配置文件属性。

msonline-UserPrincipalName

对象向导

部门

给定的名称

组类型

msOnline-IsPublic

msonline-groupType 类型

锡

经理

msOnline-ObjectId

msOnline-ObjectId

物理递送办公室名称

显示名称

WWW主页

SPO-IsSharePointOnlineObject

msonline-UserPrincipalName

部门

专有名称

msExchHideFromAddressList

标题

首选语言

msExchRecipientType详细信息

对象ID

代理地址

msonline-UserPrincipalName

msOnline-用户类型

标题

msonline-UserPrincipalName

代理地址

电话号码

请注意，此属性更新仅适用于 SharePoint Online。它无法同步到 Office 365 或 Azure AD。在 SharePoint Online 管理中心创建的用户配置文件属性不会在 Office 365 中创建或同步该属性！我们还有一个用于批量更新用户配置文件属性的 API 批量更新 SharePoint Online 的自定义用户配置文件属性