CODEWITHSUNDEEP
azureazure-active-directoryazure-cli
EchoRo
EchoRo

Reputation: 119

Create service principal from azure cli

I am trying to create a service principal from azure cli.

az login --service-principal -u servicePrincipalGuid -p spPassword --tenant tenantGuid

az ad sp create-for-rbac --skip-assignment

It works if i assign to the service principal Global administrator but it does not work with the Application Administration which according to the documentations should be sufficient.

I am wondering what roles/permissions are needed to be able to create a service principal without global administrator?

Upvotes: 0

Views: 2038

Answers (1)

Joy Wang
Joy Wang

Reputation: 42043

I can reproduce your issue, it is really weird, based on my knowledge, the Application administrator role should work.

enter image description here

The command az ad sp create-for-rbac --skip-assignment creates the app registration successfully, but it can't create the corresponding service principal. Even if I test with the command below to create service principal for the app.

az ad sp create --id '<object-id of the app registration>'

or powershell

New-AzureADServicePrincipal -AppId <object-id of the app registration>

I am wondering what roles/permissions are needed to be able to create a service principal without global administrator?

If you just want to let the command work without the global admin, you could add Application.ReadWrite.All permission of Azure Active Directory Graph like below, then it will work.

enter image description here

enter image description here

Upvotes: 2

Related Questions