Azure / Azure/azure-cli

[Feature Request] `az ad sp create-for-rbac` can show the `id`/`objectId` of the created service principal

Open
#21,009 1 comment 2 reactions 1 assignee Claimed by @jiasli View on GitHub
feature-request Microsoft Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Context

The current output of `az ad sp create-for-rbac` only shows the `appId`:

```
$ az ad sp create-for-rbac --role Reader --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590
{
"appId": "72366639-0238-4559-b44a-9db41c9a3a4b",
"displayName": "azure-cli-2022-01-17-06-01-22",
"password": "xxx",
"tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a"
}
```

However, `id`(in MS Graph)/`objectId`(in AD Graph) is used when directly calling [Role Assignments - Create](https://docs.microsoft.com/en-us/rest/api/authorization/role-assignments/create) REST API or granting admin consent (https://github.com/Azure/azure-cli/issues/20792#issuecomment-1014183586, https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479).

## Proposal

`az ad sp create-for-rbac` can show the `id`/`objectId` of the created service principal.

## Additional information

`az role assignment create` can resolve the `id`/`objectId` from `appId` when the current logged-in account has Graph read permission. If the current logged-in account doesn't have Graph read permission, `--assignee-object-id` must be specified.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.