Using az ad sp delete won't delete SP configuration
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Describe the bug**
I've created an SP for rbac via az cli. I then used the client_id and client_secret to perform az login but got an error.
The non working SP has been deleted and recreated many times, in order to test out different configuration.
I then tried creating another SP with a different name and the login worked.
This makes me think that deleting the SP still leaves some configuration in AAD, and when I recreate the SP with the same name of a previously existing one I somehow inherit that configuration.
Moreover, if I try checking the non working SP with its id, I get an error.
**To Reproduce**
I've deleted the non working SP, deleted its permissions on the Subscription and RG, and recreated it with the same name running the command:
```
az ad sp create-for-rbac --name "" --role contributor --scopes /subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME --sdk-auth
```
which will produce the following output:
```
The underlying Active Directory Graph API will be replaced by Microsoft Graph API in a future version of Azure CLI. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration
Option '--sdk-auth' has been deprecated and will be removed in a future release.
Creating 'contributor' role assignment under scope '/subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME'
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
"clientId": "CLIENT_ID",
"clientSecret": "CLIENT_SECRET",
"subscriptionId": "SUBSCRIPTION_ID",
"tenantId": "TENANT_ID",
"activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
"resourceManagerEndpointUrl": "https://management.azure.com/",
"activeDirectoryGraphResourceId": "https://graph.windows.net/",
"sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
"galleryEndpointUrl": "https://gallery.azure.com/",
"managementEndpointUrl": "https://management.core.windows.net/"
}
```
Please note that I'm using `--sdk-auth` because I want to use the SP for azure cli authentication the [azure/login@v1 action](https://github.com/Azure/login), and the documentation requires that flag.
If I try verifying the SP actually exists running `az ad sp show --id CLIENT_ID` I get:
```
The underlying Active Directory Graph API will be replaced by Microsoft Graph API in a future version of Azure CLI. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration
Resource 'CLIENT_ID' does not exist or one of its queried reference-property objects are not present.
```
**Environment summary**
```
{
"azure-cli": "2.34.1",
"azure-cli-core": "2.34.1",
"azure-cli-telemetry": "1.0.6",
"extensions": {
"containerapp": "0.1.12",
"k8s-extension": "1.0.4",
"log-analytics": "0.2.2"
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.