【Azure】CLIでサービスプリンシパルを作成してみた

#サービスプリンシパルの作成
az ad sp create-for-rbac --name SP-CLI --role Reader

#サブスクリプションIDの取得（powershellの場合はパイプのあとを「select-string "`"id`""」に変更します。）
az account show | find "id"

C:\>
C:\>az ad sp create-for-rbac --name SP-CLI --role Reader
The underlying Active Directory Graph API will be replaced by Microsoft Graph API in a future version of Azure CLI. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration
Starting from Azure CLI 2.35.0, --scopes argument will become required for creating role assignments. Please explicitly specify --scopes.
Creating 'Reader' role assignment under scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
  "appId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
  "displayName": "SP-CLI",
  "password": "7xAxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "tenant": "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
}

C:\>
C:\>az account show | find "id"
WARNING: Unable to encode the output with cp1252 encoding. Unsupported characters are discarded.
  "id": "cccccccc-cccc-cccc-cccc-cccccccccccc",

C:\>

#サービスプリンシパルの作成
$sp = New-AzADServicePrincipal -DisplayName SP
#シークレットの取得
$sp.PasswordCredentials.SecretText

#テナントIDとサブスクリプションID取得
$json = ConvertTo-Json -InputObject (Get-AzContext)
$json = ConvertFrom-Json $json
$json.Account.Tenants
$json.Subscription.Id

PS C:\> $sp = New-AzADServicePrincipal -DisplayName SP
PS C:\>
PS C:\> $sp.PasswordCredentials.SecretText
FKsxxxxxxxxxxxxxxxxxxxxxxxxxxx
PS C:\>
PS C:\> $json = ConvertTo-Json -InputObject (Get-AzContext)
PS C:\> $json = ConvertFrom-Json $json
PS C:\> $json.Account.Tenants
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
PS C:\> $json.Subscription.Id
yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
PS C:\>

New-AzADServicePrincipal -DisplayName SP2

$sp2 = Get-AzADServicePrincipal -DisplayName "SP2"
$sp2.PasswordCredentials.SecretText

PS C:\> Get-AzADServicePrincipal -DisplayName "SP2"

DisplayName Id                                   AppId
----------- --                                   -----
SP2         tttttttt-tttt-tttt-tttt-tttttttttttt uuuuuuuu-uuuu-uuuu-uuuu-uuuuuuuuuuuu


PS C:\>
PS C:\>
PS C:\> $sp2 = Get-AzADServicePrincipal -DisplayName "SP2"
PS C:\> $sp2.PasswordCredentials.SecretText
PS C:\>