Skip to content

Commit 1f74b72

Browse files
committed
Modify warnings about credential loss due to non-unique display names in az ad app create and az ad sp create-for-rbac commands
1 parent 513a9bd commit 1f74b72

File tree

2 files changed

+17
-14
lines changed

2 files changed

+17
-14
lines changed

src/azure-cli/azure/cli/command_modules/role/_help.py

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,14 @@
2222
helps['ad app create'] = """
2323
type: command
2424
short-summary: Create an application.
25-
long-summary: For more detailed documentation, see https://learn.microsoft.com/graph/api/resources/application
25+
long-summary: >-
26+
**IMPORTANT**: The `az ad app create` command can modify an existing application or service principal if
27+
another object shares the same **display name**. Display names aren't unique and can change, which
28+
could result in credential loss or incorrect RBAC assignments. Use a **unique object ID or app ID** instead.
29+
For more details, see https://go.microsoft.com/fwlink/?linkid=2342455.
30+
31+
32+
For more detailed documentation, see https://learn.microsoft.com/graph/api/resources/application
2633
examples:
2734
- name: Create an application.
2835
text: |
@@ -508,10 +515,7 @@
508515
helps['ad sp create'] = """
509516
type: command
510517
short-summary: Create a service principal.
511-
long-summary: >-
512-
**IMPORTANT**: The `az ad sp create` command can modify an existing application or service principal if
513-
another object shares the same **display name**. Display names aren't unique and can change, which
514-
could result in credential loss or incorrect RBAC assignments. Use a **unique object ID or app ID** instead.
518+
long-summary:
515519
examples:
516520
- name: Create a service principal. (autogenerated)
517521
text: az ad sp create --id 00000000-0000-0000-0000-000000000000
@@ -527,6 +531,7 @@
527531
**IMPORTANT**: The `az ad sp create-for-rbac` command can modify an existing application or service principal if
528532
another object shares the same **display name**. Display names aren't unique and can change, which
529533
could result in credential loss or incorrect RBAC assignments. Use a **unique object ID or app ID** instead.
534+
For more details, see https://go.microsoft.com/fwlink/?linkid=2342455.
530535
531536
532537
The output includes credentials that you must protect. Be sure that you do not include these credentials

src/azure-cli/azure/cli/command_modules/role/custom.py

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,13 @@ def create_application(cmd, client, display_name, identifier_uris=None,
604604
# JSON properties
605605
app_roles=None, optional_claims=None, required_resource_accesses=None):
606606
# pylint:disable=too-many-locals
607+
608+
logger.warning(f"The `az {cmd.name}` command can modify an existing application or service principal "
609+
"if another object shares the same display name. Display names aren't unique and can change, "
610+
"which could result in credential loss or incorrect RBAC assignments. "
611+
"Use a unique object ID or app ID instead. For more details, "
612+
"see https://go.microsoft.com/fwlink/?linkid=2342455.")
613+
607614
graph_client = _graph_client_factory(cmd.cli_ctx)
608615

609616
existing_apps = list_applications(cmd, client, display_name=display_name)
@@ -1017,10 +1024,6 @@ def app_federated_credential_delete(client, app_identifier, federated_identity_c
10171024

10181025

10191026
def create_service_principal(cmd, identifier):
1020-
logger.warning("The `az ad sp create` command can modify an existing application or service principal "
1021-
"if another object shares the same display name. Display names aren't unique and can change, "
1022-
"which could result in credential loss or incorrect RBAC assignments. "
1023-
"Use a unique object ID or app ID instead.")
10241027
return _create_service_principal(cmd.cli_ctx, identifier)
10251028

10261029

@@ -1149,11 +1152,6 @@ def create_service_principal_for_rbac(
11491152
show_auth_in_json=None, skip_assignment=False, keyvault=None):
11501153
import time
11511154

1152-
logger.warning("The `az ad sp create-for-rbac` command can modify an existing application or service principal "
1153-
"if another object shares the same display name. Display names aren't unique and can change, "
1154-
"which could result in credential loss or incorrect RBAC assignments. "
1155-
"Use a unique object ID or app ID instead.")
1156-
11571155
if role and not scopes or not role and scopes:
11581156
raise ArgumentUsageError("Usage error: To create role assignments, specify both --role and --scopes.")
11591157

0 commit comments

Comments
 (0)