Azure Key Vault - 访问被拒绝

我正在创建一个Azure Key Vault . 我使用下面的ARM JSON模板 . 我在Azure AD中创建了一个应用程序，我正在尝试为该应用程序授予所有权限，以便我可以使用此Apps凭据从Key Vault客户端连接到Key Vault .

我正在使用TFS，并创建了“Azure部署：创建或更新资源组”版本定义任务以自动执行此操作 .

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
  "parameters": {
    "vaults_qnvaultdev_name": {      
      "type": "string"
    },
    "vaults_location": {     
      "type": "string"
    },
    "vaults_skufamily": {      
      "type": "string"
    },
    "vaults_skuname": {
      "type": "string"
    },
    "vaults_tenantid": {
      "type": "string"
    },
    "vaults_objectid": {
      "type": "string"
    }
  },
    "variables": {},
    "resources": [
      {
        "comments": "Generalized from resource: '/subscriptions/subscription().subscriptionId/resourceGroups/resourceGroup().name/providers/Microsoft.KeyVault/vaults/[parameters('vaults_qnvaultdev_name')]'.",
        "type": "Microsoft.KeyVault/vaults",
        "name": "[parameters('vaults_qnvaultdev_name')]",
        "apiVersion": "2015-06-01",
        "location": "[parameters('vaults_location')]",
        "tags": {},
        "scale": null,
        "properties": {
          "sku": {
            "family": "[parameters('vaults_skufamily')]",
            "name": "[parameters('vaults_skuname')]"
          },
          "tenantId": "[parameters('vaults_tenantid')]",
          "accessPolicies": [
            {
              "tenantId": "[parameters('vaults_tenantid')]",
              "objectId": "[parameters('vaults_objectid')]",
              "permissions": {
                "keys": [
                  "All",
                  "Get",
                  "List",
                  "Update",
                  "Create",
                  "Import",
                  "Delete",
                  "Recover",
                  "Backup",
                  "Restore"
                ],
                "secrets": [
                  "All",
                  "Get",
                  "List",
                  "Set",
                  "Delete",
                  "Recover",
                  "Backup",
                  "Restore"
                ]
              }
            }
          ],
          "enabledForDeployment": true
        },
        "dependsOn": []
      }
    ]
}

模板执行正常，并且正在创建密钥保管库 . 我还可以在保险库的访问策略中看到，Principal正在添加所有权限 . 但是，在创建保管库后，当我使用Principal的客户端ID和密钥从客户端应用程序进行连接时，我收到“拒绝访问”错误 .

我注意到，如果我通过门户网站并通过Key Vault的访问策略手动添加应用程序，则Vault客户端可以成功进行身份验证 . 我在这里错过了什么吗？

Update: Issue fixed 我手动将应用程序权限授予了Vault的访问策略，并检查了资源门户 . 然后我看到资源门户中生成的此应用程序的"Object Id"与我在Azure AD中看到的不同 - 在此应用程序的门户中 . 任何想法为什么这些不同？