Can Azure Service Principal Update Its Own Passwords?

Question

I need to use an Azure service principal to programmatically:
1. add/delete passwords for other services principal , and
2. add/delete passwords for itself

1 is easy to do.

But I can't seem to do 2 due to the following error. Is #2 possible? How?

graphrbac.PasswordCredentialsUpdateParameters failed:
graphrbac.ApplicationsClient#UpdatePasswordCredentials: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" 
Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2019-06-06T22:19:35","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"<ID>"}}]

Answer 1

Is #2 possible? How?

Yes, it is possible.

Just add your service principal to the Application Administrator directory role in your tenant, no need to add other permissions, it will work(there may be some delay).

Navigate to the Azure Active Directory in the portal -> Roles and administrators -> click Application administrator -> Add assignment -> search by your AD App name(service principal name) -> select it -> Select.

My test sample:

I test it with powershell, in other languages, it should also work.

Add password:

Connect-AzureAD -TenantId "<TenantId>" -ApplicationId "<ApplicationId>" -CertificateThumbprint "D0F0B179xxxxx6E41833FDE5947"
New-AzureADApplicationPasswordCredential -ObjectId <ObjectId>

Remove password(it returns no content when successful):

$password = Get-AzureADApplicationPasswordCredential -ObjectId <ObjectId>
Remove-AzureADApplicationPasswordCredential -ObjectId <ObjectId> -KeyId $password.KeyId

Besides, you could check the screenshot in my test sample and that in the portal, make sure the service principal add/delete passwords for itself.

Answer 2

Seems you are trying to update your service principle meanwhile caught an error.

As the error said you don't have permission for this operation.

Reason of Error: You may not have sufficient permission on your application for this operation.

Action To Do:

To do that you have to assign following permission on your application. Please follow the below steps:

1. Login to azure portal
2. Click on azure active directory
3. App registrations
4. Select you application
5. API Permission
6. Add Permission
7. Microsoft Graph
8. Application permission
9. In Directory select Directory.Read.All
10. In Application select Application.ReadWrite.All
11. Add Permission
12. Grant admin consent for YourTennant

See the screen shot below:

Note: You also need to have at least Contributor directory role on that application. As the Contributor can create and manage all types of Azure resources but can’t grant access to others.