Azure / Azure/azure-cli

`az ad app create` and `az ad sp create-for-rbac` should not be idempotent

Open
#30,427 2 comments 1 reaction 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign Azure CLI Team feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az ad app create`
`az ad sp create-for-rbac`

**Is your feature request related to a problem? Please describe.**
Derived from IcM 568027592

#9108 made `az ad app create` and `az ad sp create-for-rbac` use `displayName` to uniquely identify an application. If an application with the specified `displayName` already exists, Azure CLI will `PATCH` it with the newly provided properties by calling [Update application](https://learn.microsoft.com/en-us/graph/api/application-update?view=graph-rest-1.0&tabs=http) API. This API requires [`microsoft.directory/applications/basic/update`](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-available-permissions#microsoftdirectoryapplicationsbasicupdate) permission that a user may not possess. The user may only have [`microsoft.directory/applications/createAsOwner`](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-available-permissions#microsoftdirectoryapplicationscreateasowner) and expect these commands to work.

This behavior is not aligned with the underlying [Create application](https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0&tabs=http) API where `displayName` is not used as a primary key and multiple applications can have the same `displayName`. Creating applications with the same `displayName` will create multiple applications.

**Describe the solution you'd like**
Change this behavior to align with the underlying [Create application](https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0&tabs=http) API, PowerShell and Entra portal to eliminate possible confusions. In other words, the change will make calling `az ad app create` or `az ad sp create-for-rbac` multiple times create multiple applications with the same `displayName`.

**Describe alternatives you've considered**
Explicitly document this behavior and define it as by-design.

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.