CODEWITHSUNDEEP
pythonazurerbacservice-principal
Mr. Developerdude
Mr. Developerdude

Reputation: 9648

Create service principal programmatically in Azure Python API

How can I, using the Azure Python API, create a full set of credentials that can later be used to start and deallocate all VMs in a named resource group, without any other permissions?

I have thoroughly researched the example code and both official and unofficial documentation, but I don't even know where to start...

I know I will need a tenant ID, client ID, client secret and subscription ID. Which of those can I make using an API, and how would I go about assigning roles to allow for starting/deallocating VMs of an existing resource group?

Sample code highly sought after, but will take any hint!

Upvotes: 3

Views: 5059

Answers (2)

rodmanb
rodmanb

Reputation: 101

To anyone still arriving at this question, python's azure-rbac has been deprecated since December 20, 2022 (but not widely documented, at the time of this comment).

Seems like the Azure CLI is the best solution right now , with Graph API being another possible course but that's also not very documented.

Upvotes: 0

Laurent Mazuel
Laurent Mazuel

Reputation: 3546

You need the azure-graphrbac package to create a Service Principal:

The closer to a sample might be this unittest:

For role and permissions, you need azure-mgmt-authorization:

Best sample for this one, is probably the sub-part of this sample:

"msi_identity" is a synonym of "service principal" in your context.

Note that all of this is supported by the CLI v2.0:

It might be interested to test the CLI in --debug mode and sniffing in the code repo at the same time:

(full disclosure, I work at MS in the Azure SDK for Python team)

Upvotes: 6

Related Questions