az ad sp show seems not to be working as expected

[binte]

When running the following command:

az ad sp show --id http://$SP_NAME

I will always get an error (below) if $SP_NAME is the service principal display name, and not its ID.

Service principal ... doesn't exist

The $SP_NAME variable contains the exact same display name as I see in the App Registrations in Azure AD.

---

When deploying a service principal via script, we do not have the service principal object ID prior to running the script, only the name we want to assign to the service principal (display name). Not only this used to work a few months back, as per the documentation it should still work!

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: e99d25ff-03e2-e015-37f4-a29b59ec50d4
• Version Independent ID: 1a8e88ed-72c7-fbe7-b0ad-68f23b3946cd
• Content: az ad sp
• Content Source: latest/docs-ref-autogen/ad/sp.yml
• Service: active-directory
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

@jiasli for awareness

[jiasli]

Azure CLI command az ad sp create-for-rbac doesn't create apps with identifierUris anymore (#18312), so showing an SP created by az ad sp create-for-rbac with identifierUris (http://<display-name>) doesn't work now. Please use the appId of the app or objectId of the SP in az ad sp show --id.

[binte]

So, that is why my scripts stopped working :) Thank you for the explanation! In the meantime, I was able to have my scripts work again by updating the az ad sp create-for-rbac command, to the following:

az ad sp create-for-rbac --name $SP_NAME --id http://$SP_NAME

So, I explicitly create the id I was using before #18312 when running the az ad sp create-for-rbac command. More information on this SO question

[jiasli]

I don't think --id http://$SP_NAME will work, as az ad sp create-for-rbac doesn't take an --id argument:

> az ad sp create-for-rbac --name "myapp0819" --id "http://myapp0819"
unrecognized arguments: --id http://myapp0819

With Azure CLI, the only way to update identifierUris of an app is through az ad app create and az ad app update.

We don't recommend using identifierUris for simple apps (for example, those you use in Azure RBAC) because in the future AAD will require all URIs must be on verified domains. When the check is rolled out, your script will break again if the identifierUris don't meet the requirement, as described in #18312.

[binte]

Indeed you are right, the solution I proposed does not work. Thanks for the information @jiasli