az ad sp credential list does not show the same as the Azure portal

[yrro]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az ad sp credential list --id ID

Errors:
The output shows me the credential reset with az ad sp credential reset --id ID. But in the Azure portal, looking at the app registration's secrets, there is a different secret displayed with a different (shorter) expiry date.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Create an app registration
• Create a secret in the Azure portal. Max lifetime is 2 years 🤦
• az ad sp credential list --id ID outputs nothing. The secret created in the Azure portal cannot be seen in the CLI
• az ad sp credential reset --id ID --years 100
• Look at the app registration's secrets in the Azure portal. The newly created secret is not there - the old one is still present
• az ad sp credential list --id ID will show the new 100 year secret.

Expected Behavior

Environment Summary

Linux-5.18.0-3-amd64-x86_64-with-glibc2.34, Debian GNU/Linux 11 (bullseye)
Python 3.10.5
Installer: DEB

azure-cli 2.39.0

Extensions:
azure-firewall 0.13.0
ip-group 0.1.2
support 1.0.3

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

[yonzhan]

@jiasli for awareness

[yrro]

I've done a bit more experimentation. Created a brand new app registration and reset its secret with az ad app credential reset. After a few minutes (and a web page refresh) the new credential appears in the Azure portal.

So I think it's simply that the docs are wrong: az ad sp ... commands are not equivalent to az ad app ... commands; they operate on the enterprise application, as opposed to the app registration.

To be precise, this page says:

The credential update will be applied on the Application object the service principal is associated with. In other words, you can accomplish the same thing using "az ad app credential".

The same text is visible in the output of az ad sp credential --help.

So it appears that enterprise applications/service principals have their own set of secrets, that are not visible anywhere in the Azure portal. A fun place to stash away backdoor credentials!

[RakeshMohanMSFT]

@yrro Thank you for reaching out, we will look into it.

[RakeshMohanMSFT]

@yrro Thank you for reaching out to us. As you pointed out they are used for different purposes. az ad app credential list uses application api for ad graph and az ad sp credential list uses the application api.

We will get the document updated to use better words to avoid confusion.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[yrro]

I don't think there's any feedback required from me?

[RakeshMohanMSFT]

@yrro No we do not need it. Thank you. I will close this thread, if you have no further questions.

[yrro]

Is there a link to the issue # for the doc update?

[RakeshMohanMSFT]

@yrro No yet. We will get it updated soon.

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[yrro]

https://learn.microsoft.com/en-us/cli/azure/ad/sp/credential?view=azure-cli-latest no longer has text similar to 'The credential update will be applied on the Application object the service principal is associated with. In other words, you can accomplish the same thing using "az ad app credential".' so I am closing this issue.

[jiasli]

Duplicate of #23566