`az ad app credential reset`/`az ad sp create-for-rbac`: `--years` adds 366 days in leap years
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Related command**
`az ad app credential reset`
`az ad sp create-for-rbac`
**Is your feature request related to a problem? Please describe.**
Currently, `--years` is added directly to the current year to compute the credential end date:
https://github.com/Azure/azure-cli/blob/03ad904956bbac343b409da0d2ba6cce7e240f0d/src/azure-cli/azure/cli/command_modules/role/custom.py#L1176-L1177
If the time range contains a leap year, 366 days will be added.
```py
from dateutil.relativedelta import relativedelta
from datetime import datetime
print(datetime(2023, 1, 1) + relativedelta(years=1) - datetime(2023, 1, 1))
# output: 365 days, 0:00:00
print(datetime(2024, 1, 1) + relativedelta(years=1) - datetime(2024, 1, 1))
# output: 366 days, 0:00:00
```
> [!CAUTION]
> **If there is a policy in the tenant that forbids expiry time longer than 365 days, the 366 day expiry time will cause commands to fail.**
Luckily, now is already past 2024-02-29, so the next time it will happen is 2028.
**Describe the solution you'd like**
Use `datetime.timedelta` instead of `dateutil.relativedelta.relativedelta` to add exactly 365 days per year, regardless of leap years, in order to make the computed end date definitive.
Azure Portal uses exactly 365 days:

Contributor guide
Assessment
This issue has not been assessed yet.