Skip to content

az ad app create and az ad sp create-for-rbac should not be idempotent #30427

@jiasli

Description

@jiasli

Related command
az ad app create
az ad sp create-for-rbac

Is your feature request related to a problem? Please describe.
Derived from IcM 568027592

#9108 made az ad app create and az ad sp create-for-rbac use displayName to uniquely identify an application. If an application with the specified displayName already exists, Azure CLI will PATCH it with the newly provided properties by calling Update application API. This API requires microsoft.directory/applications/basic/update permission that a user may not possess. The user may only have microsoft.directory/applications/createAsOwner and expect these commands to work.

This behavior is not aligned with the underlying Create application API where displayName is not used as a primary key and multiple applications can have the same displayName. Creating applications with the same displayName will create multiple applications.

Describe the solution you'd like
Change this behavior to align with the underlying Create application API, PowerShell and Entra portal to eliminate possible confusions. In other words, the change will make calling az ad app create or az ad sp create-for-rbac multiple times create multiple applications with the same displayName.

Describe alternatives you've considered
Explicitly document this behavior and define it as by-design.

Additional context

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions