AzureDevops Connection Permission for Cycling Service Principal Secret - azure

Question

I am trying to create a release in AzureDevops that checks the expiration of SP secrets and then updates them if necessary. I have the part that does the check:
param (
[string]$SpId
)
$SpSecret
$SpEndDate = az ad sp credential list --id $SpId --query "[].{Key:endDate}" -o tsv
((Get-Date $SpEndDate).AddDays(-30) -lt (Get-Date)) {
#Set a new secret value if it is about to expire
$SpSecret = az ad sp credential reset --name $SpId --query password -o tsv
}
Write-Host "##vso[task.setvariable variable=var01;Secret=true]$SpSecret"
Write-Host $env:Secret
The issue now is that the service connection does not have the permissions to run "z ad sp credential reset". I have looked at the connection and don't see a permission that will work. Any suggestions?

Answer 1

When you create the Azure Resource Manager service connection to use the AzureCLI, the system will create an AD App for you automatically, check this link.
If you use this service connection with AzureCLI, it will use the credential of the service principal of the AD App in your tenant. For the concept of service principal and AD App, see this link.
To fix the issue, navigate to the Azure Active Directory in the portal -> App registrations -> All applications -> find the application corresponding to the service connection, its name should be like organizationname-projectname-513f22f1-befd-xxxxxxcfe90f1. Then click it -> add the permission like the screenshots(Note: your user account need the admin role to click the Grant admin consent button, e.g. Global admin ).
After granting the permission, wait for a while, the service principal of the service connection will be able to create the AD App, the Azure CLI task should work fine.
The Application.ReadWrite.All permission will allow the service principal to create, read, update and delete all applications and service principals. If you want to avoid the security problem, you can also use the powershell to add the service principal of the service connection as an Owner to the service principal which you want to reset credential. Then just need to add Application.ReadWrite.OwnedBy permission in the screenshot above.
Navigate to the organizationname-projectname-513f22f1-befd-xxxxxxcfe90f1 app in the portal -> click the Managed application in local directory as below.
Then copy the Object ID in the screenshot.
Then use the powershell below(At least you need to be the Owner of the target App to run the command).
Add-AzureADApplicationOwner -ObjectId <ObjectId of the app which corresponding to the service principal> -RefObjectId <ObjectId of the service connection corresponding service principal>
Besides: At first, I suppose Add-AzureADServicePrincipalOwner is enough, but per my test, it does not work, looks may be Application.ReadWrite.OwnedBy does not allow to operate on the service principal corresponding to the AD App.