Can I programmatically create new passwords for Azure Service Principals?

Question

I am trying to make a program that does secret rotation for Azure resources. One of the secrets I want to rotate is a Service principal password. I was wondering if I have the ability to programmatically do the following:

1. Make a new password for an existing service principal
2. Delete a password for an existing service principal

I haven't been able to find anything in the docs for the C# sdk, the REST API, the cli, or Powershell. Any help would be appreciated. Thanks!

Answer 1

Try the powershell command below.

Create new password: New-AzureADApplicationPasswordCredential

Delete a password: Remove-AzureADApplicationPasswordCredential

Answer 2

That's relatively simple stuff that can be achieved with Azure CLI. Make sure you have Azure CLI 2.0 installed. To manage SP's use: az ad sp (check what it does with az ad sp --help). To manage credentials use: az ad sp credential (it has delete/list/reset commands available). Using this CLI commands you should be able to achieve the desired effect.

Answer 3

Theres this little utility on Github, that rotates it through an azure function. C# code with Managed Identity

https://github.com/3mcloud/azure-keyvault-rotator

https://abschmidt.medium.com/rotating-service-principal-secrets-automatically-in-azure-key-vault-c4f04a84c9af

Answer 4

Powershell and CLI:

az ad sp credential reset --name <objectid>