Skip to content

Add credential and role assignment warning for creating service principal #2400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dbradish-microsoft merged 2 commits into from
Feb 16, 2021
Merged

Add credential and role assignment warning for creating service principal #2400

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b54a2bb
sp warning
jiasli Jan 19, 2021
70d30be
bold
jiasli Jan 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion docs-ref-conceptual/create-an-azure-service-principal-azure-cli.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,19 @@ This article shows you the steps for creating, getting information about, and re

Create a service principal with the [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command. When creating a service principal, you choose the type of sign-in authentication it uses.

There are two types of authentication available for service principals: Password-based authentication, and certificate-based authentication.

Comment on lines +32 to +33
Copy link
Member Author

@jiasli jiasli Jan 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just want to put [!NOTE] and [!WARNING] together, hence the change.

> [!NOTE]
>
> If your account doesn't have permission to create a service principal, `az ad sp create-for-rbac` will return an error message containing
> "Insufficient privileges to complete the operation." Contact your Azure Active Directory admin to create a service principal.

There are two types of authentication available for service principals: Password-based authentication, and certificate-based authentication.
> [!WARNING]
> When you create a service principal using the `az ad sp create-for-rbac` command, the output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. As an alternative, consider using [managed identities](/azure/active-directory/managed-identities-azure-resources/overview) if available to avoid the need to use credentials.
>
> By default, `az ad sp create-for-rbac` assigns the [Contributor](/azure/role-based-access-control/built-in-roles#contributor) role to the service principal at the subscription scope. To reduce your risk of a compromised service principal, assign a more specific role and narrow the scope to a resource or resource group. See [Steps to add a role assignment](/azure/role-based-access-control/role-assignments-steps) for more information.
>
> In a future release, `az ad sp create-for-rbac` will NOT create a **Contributor** role assignment by default. If needed, use the `--role` argument to explicitly create a role assignment.
Copy link
Member Author

@jiasli jiasli Jan 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the preview, hyperlink Contributor is rendered as bold text, so mark the second Contributor as bold text too.

image

Meanwhile, az ad sp create-for-rbac uses single quotes as it will be shown in az ad sp create-for-rbac --help when run in a terminal.

WARNING: In a future release, this command will NOT create a 'Contributor' role assignment by default.


### Password-based authentication

Expand Down