You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/ResourceManager/Resources/ChangeLog.md
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,11 @@
18
18
- Additional information about change #1
19
19
-->
20
20
## Current Release
21
+
* Revert change to `New-AzureRmADServicePrincipal` that gave service principals "Contributor" permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
22
+
- If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
23
+
- If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
24
+
- If a `Scope` is provided, but no `Contributor`, the service principal is created with `Contributor` permissions over the specified `Scope`
25
+
- If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`
21
26
22
27
## Version 6.0.0
23
28
* Set minimum dependency of module to PowerShell 5.0
HelpMessage="The display name for the application.")]
59
-
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The display name for the application.")]
59
+
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The display name for the application. If a display name is not provided, "+
60
+
"this value will default to 'azure-powershell-MM-dd-yyyy-HH-mm-ss', where the suffix is the time of application creation.")]
60
61
[ValidateNotNullOrEmpty]
61
62
publicstringDisplayName{get;set;}
62
63
@@ -96,7 +97,8 @@ public class NewAzureADServicePrincipalCommand : ActiveDirectoryBaseCmdlet
96
97
HelpMessage="The value for the password credential associated with the application that will be valid for one year by default.")]
HelpMessage="The value for the password credential associated with the application that will be valid for one year by default.")]
99
-
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The value for the password credential associated with the application.")]
100
+
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The value for the password credential associated with the application. If a "+
101
+
"password is not provided, a random GUID will be generated and used as the password.")]
100
102
[ValidateNotNullOrEmpty]
101
103
publicSecureStringPassword{get;set;}
102
104
@@ -141,11 +143,14 @@ public class NewAzureADServicePrincipalCommand : ActiveDirectoryBaseCmdlet
141
143
HelpMessage="The end date till which password or key is valid. Default value is one year after the start date.")]
142
144
publicDateTimeEndDate{get;set;}
143
145
144
-
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The scope that the service principal has permissions on.")]
146
+
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The scope that the service principal has permissions on. If a value for Role is provided, but "+
147
+
"no value is provided for Scope, then Scope will default to the current subscription.")]
145
148
[ScopeCompleter]
146
149
publicstringScope{get;set;}
147
150
148
-
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The role that the service principal has over the scope.")]
151
+
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="The role that the service principal has over the scope. If a value for Scope is provided, but "+
152
+
"no value is provided for Role, then Role will default to the 'Contributor' role.")]
[Parameter(Mandatory=false,ParameterSetName=SimpleParameterSet,HelpMessage="If set, will skip creating the default role assignment for the service principal.")]
if(ShouldProcess(target:createParameters.ApplicationId.ToString(),action:string.Format("Adding a new service principal to be associated with an application having AppId '{0}'",createParameters.ApplicationId)))
353
+
varshouldProcessMessage=SkipRoleAssignment()?
354
+
string.Format("Adding a new service principal to be associated with an application "+
355
+
"having AppId '{0}' with no permissions.",createParameters.ApplicationId):
356
+
string.Format("Adding a new service principal to be associated with an application "+
357
+
"having AppId '{0}' with '{1}' role over scope '{2}'.",createParameters.ApplicationId,this.Role,this.Scope);
Creates a new azure active directory service principal.
116
+
Creates a new azure active directory service principal. The default parameter set uses default values for parameters if the user does not provide one for them. For more information on the default values used, please see the description for the given parameters below.
117
+
118
+
This cmdlet has the ability to assign a role to the service principal with the `Role` and `Scope` parameters; if neither of these parameters are provided, no role will be assigned to the service principal. The default values for the `Role` and `Scope` parameters are "Contributor" and the current subscription, respectively (_note_: the defaults are only used when the user provides a value for one of the two parameters, but not the other).
117
119
118
-
Note: The cmdlet also implicitly creates an application and sets its properties (if the ApplicationId is not provided).
119
-
In order to update the application specific parameters please use Set-AzureRmADApplication cmdlet.
120
+
The cmdlet also implicitly creates an application and sets its properties (if the ApplicationId is not provided). In order to update the application specific parameters please use Set-AzureRmADApplication cmdlet.
120
121
121
122
## EXAMPLES
122
123
123
-
### Example 1 - Create a new AD service principal using application id
124
+
### Example 1 - Simple AD service principal creation
The above command creates an AD service principal using default values for parameters not provided. Since an application id was not provided, an application was created for the service principal. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
137
+
138
+
### Example 2 - Simple AD service principal creation with a specified role and default scope
WARNING: Assigning role 'Reader' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz' to the new service principal.
150
+
```
151
+
152
+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Reader" permissions over the current subscription (since no value was provided for the `Scope` parameter).
153
+
154
+
155
+
### Example 3 - Simple AD service principal creation with a specified scope and default role
WARNING: Assigning role 'Contributor' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup' to the new service principal.
167
+
```
168
+
169
+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Contributor" permissions (since no value was provided for the `Role` parameter) over the provided resource group scope.
170
+
171
+
### Example 4 - Simple AD service principal creation with a specified scope and role
WARNING: Assigning role 'Reader' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup' to the new service principal.
183
+
```
184
+
185
+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Reader" permissions over the provided resource group scope.
186
+
187
+
### Example 5 - Create a new AD service principal using application id with role assignment
Creates a new AD service principal for the application with application id '34a28ad2-dec4-4a41-bc3b-d22ddf90000e'.
199
+
Creates a new AD service principal for the application with application id '34a28ad2-dec4-4a41-bc3b-d22ddf90000e'. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
130
200
131
-
### Example 2 - Create a new AD service principal for no appplication
201
+
### Example 6 - Create a new AD service principal for no appplication
Creates a new AD service principal without needing an existing application. This will implicitly create an application since one is not provided.
214
+
Creates a new AD service principal without needing an existing application. This will implicitly create an application since one is not provided. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
139
215
140
-
### Example 3 - Create a new AD service principal using piping
216
+
### Example 7 - Create a new AD service principal using piping
The friendly name of the service principal. If a display name is not provided, this value will default to 'azure-powershell-MM-dd-yyyy-HH-mm-ss', where the suffix is the time of application creation.
The role that the service principal has over the scope.
463
+
The role that the service principal has over the scope. If a value for `Scope` is provided, but no value is provided for `Role`, then `Role` will default to the 'Contributor' role.
The scope that the service principal has permissions on.
478
+
The scope that the service principal has permissions on. If a value for `Role` is provided, but no value is provided for `Scope`, then `Scope` will default to the current subscription.
0 commit comments