12

I have created a RBAC enabled service principal in Azure to configure Key Vault access within my OS using environment variables. When you create a service principal, the Azure CLI responds with the service principal details, containing the clientSecret value. Creation command:

az ad sp create-for-rbac -n <http://my-name> --sdk-auth

I would like to know if and how I can request the clientSecret later on. When I use

az ad sp show --id <my-service-principal-uuid>

or

az ad sp credential list --id <my-service-principal-uuid>

the clientSecret is not in the response information.

Is there any way to retrieve the clientSecret other than at the moment of creation?

marcuse
  • 3,389
  • 3
  • 29
  • 50

2 Answers2

10

You cannot retrieve it after creation. The best you can do is to reset it, at which point you will be shown the new value:

PS C:\> az ad sp credential reset --name foo
{
  "appId": "...",
  "name": "foo",
  "password": "...",
  "tenant": "..."
}

This means that you will need to update the credential manually wherever you've made use of it, for example in Azure DevOps if you've created an Azure RM service connection with that particular service principal.

Moss
  • 855
  • 1
  • 9
  • 23
2

You can get like below

Create a service principal

SPA_SP_APP_ID=$(az ad sp create-for-rbac --name $AKS_SP_NAME --skip-assignment --query appId)

Retrieve Service principal APPID and Client Secret

 SPA_SP_SECRET=$(az ad sp credential reset --name $SPA_SP_APP_ID --query "password")

EDIT

As Moss Mentioned above, you cannot retrieve once it is created.

Sajeetharan
  • 216,225
  • 63
  • 350
  • 396