pac admin create-service-principal ideas

[Laskewitz]

I have a couple of ideas for the pac admin create-service-principal command:

• I would love to have a --name param to control the name of the SPN. Since it appears in the UI, it would be a good option.
• The --environment param is required, could it be changed to optional and use the default value of the currently selected environment? If the user wants to, they can use the --environment param to override the default value and change it to the environment of their liking.
• Is it possible to get a command to add an app user to Dataverse? For instance: pac admin create-app-user. In a lot of orgs, people who are developing on Dataverse are not allowed to create SPNs.

[petrochuk]

@Laskewitz - this discussion is a winner as most upvoted idea, so we are making these changes in next version.

[rajyraman]

@Laskewitz - Assigning a role to an Application User adds it to the environment (https://learn.microsoft.com/en-us/power-platform/developer/cli/reference/admin#assign-an-application-user-to-an-environment-with-the-system-administrator-role). So this capability already exists.

[rafaelkhalilyullov]

I've tried this new command and got the following error:

Error: We didn't find that application ID 5a273635-2141-4641-ab25-e8d7fab2e7e8 in your Azure Active Directory (Azure AD) with CorrelationID 37f4a156-251e-4b6d-a38c-ab7aaf5115f1. Make sure your application is registered in Azure AD.

I've previously implemented a script in Powershell using Azure CLI to create an Application Registration, create a secret for it, providing access to the environment. And faced a similar error from time to time. And finally, it was fixed by adding a pause between creating Application Registration, creating a secret for it, and providing it with access to env. Plus, I've identified that the manifest is a bit different if I create an Application Registration via UI and via CLI. So, I've added a small piece to have the same manifest.

There are commands below for creating an app, creating a secret, and providing access to env that I've used and that work for me:

    $appRegName = "app-reg-ci-cd-$ProjectCode-$Stage"
    $secretName = "deployment pipelines"
    $pacAuthProfileName = "$ProjectCode-$Stage"
    $variableGroupDescription = "Variable group for deploying solutions to $Stage environment"

    # create app reg
    $appRegName
    $app = (az ad app create --display-name $appRegName --sign-in-audience AzureADMyOrg --required-resource-accesses ./assets/manifest.json --output json) | ConvertFrom-Json
    $clientId = $app.appId

    # create corresponding sp
    az ad sp create --id $clientId --output json

    #New-PowerAppManagementApp -ApplicationId $AD_AppRegID
    
    # create secret for app reg
    $secret = (az ad app credential reset --id $clientId --append --display-name $secretName --output json) | ConvertFrom-Json
    $clientSecret = $secret.password 

    ... do some other stuff that takes some time (e.g. save all this to the Azure DevOps variable groups, generate solutions, and so on)
   
    $role = "System Administrator"
    $clientId = $variableGroup.variables.ClientId.value
    $envUrl = $variableGroup.variables.EnvUrl.value

    # assign role to app reg in target env
    pac admin assign-user --environment $envUrl --user $clientId --role $role --application-user

manifest.json

[{
    "resourceAppId": "00000003-0000-0000-c000-000000000000",
    "resourceAccess": [
        {
            "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
            "type": "Scope"
        }
    ]
}]

[petrochuk]

Closing as recent 1.26 version of pac cli implements these changes