[Feature Request] `az ad sp create-for-rbac` can show the `id`/`objectId` of the created service principal
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Context
The current output of `az ad sp create-for-rbac` only shows the `appId`:
```
$ az ad sp create-for-rbac --role Reader --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590
{
"appId": "72366639-0238-4559-b44a-9db41c9a3a4b",
"displayName": "azure-cli-2022-01-17-06-01-22",
"password": "xxx",
"tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a"
}
```
However, `id`(in MS Graph)/`objectId`(in AD Graph) is used when directly calling [Role Assignments - Create](https://docs.microsoft.com/en-us/rest/api/authorization/role-assignments/create) REST API or granting admin consent (https://github.com/Azure/azure-cli/issues/20792#issuecomment-1014183586, https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479).
## Proposal
`az ad sp create-for-rbac` can show the `id`/`objectId` of the created service principal.
## Additional information
`az role assignment create` can resolve the `id`/`objectId` from `appId` when the current logged-in account has Graph read permission. If the current logged-in account doesn't have Graph read permission, `--assignee-object-id` must be specified.
Contributor guide
Assessment
This issue has not been assessed yet.