Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Adding note about change in behaviour for az cli #23413

Closed
wants to merge 1 commit into from
Closed

Adding note about change in behaviour for az cli #23413

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/azure-cli/azure/cli/command_modules/role/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,11 @@
The output includes credentials that you must protect. Be sure that you do not include these credentials
in your code or check the credentials into your source control. As an alternative, consider using
[managed identities](https://aka.ms/azadsp-managed-identities) if available to avoid the need to use credentials.

**Note:** This command resets the credentials of the Service Principal, not the App Registration.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good catch! But I guess you put this statement at the wrong place? ad app credential reset does reset the credential of the application, not service principal.

The help message for az ad sp credential reset is here:

azure-cli/src/azure-cli/azure/cli/command_modules/role/_help.py

Lines 527 to 531 in 33cbd01

helps['ad sp credential'] = """
type: group
short-summary: Manage a service principal's credentials.
long-summary: The credential update will be applied on the Application object the service principal is associated with. In other words, you can accomplish the same thing using "az ad app credential"
"""

As for the behavior change, we called out in https://docs.microsoft.com/en-us/cli/azure/microsoft-graph-migration#az-ad-sp-credential

As such, the credential shown in the output will be different from the credential shown in the portal under the App Registration pane.
Credentials of a Service Principal are not visable in the portal, only via the az cli or Microsoft Graph API.
Comment on lines +120 to +121
Copy link
Member

@jiasli jiasli Aug 3, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't want to describe the behavior of Azure Portal since Azure Portal are subject to change, which is hard to maintain. Once Azure Portal changes its behavior, CLI's document will be outdated.

To act on the credentials of the App Registration, please use the az ad app family of commands.
examples:
- name: Append a certificate to the application with the certificate string.
text: az ad app credential reset --id 00000000-0000-0000-0000-000000000000 --cert "MIICoT..." --append
Expand Down