Error creating AKS cluster in ARM with service principal in MS Graph

Question

I'm using the Resource Manager REST API to deploy an AKS cluster. To create the app and service principal it needs, I'm using Microsoft Graph (not Azure AD Graph).

The problem I'm running into is that there seems to be a lag between when I create the app and SP, and when they become visible in ARM. If I try creating the cluster straight after the app, I get the following error:

Bad Request (HTTP 400).
Service principal clientID: <client-id> not found in Active Directory tenant
72f988bf-86f1-41af-91ab-2d7cd011db47, Please see https://aka.ms/acs-sp-help for more details.

I can verify in the portal that the app with the specified client ID does exist, as does the service principal. If I wait a couple of minutes, then the AKS cluster creation succeeds.

Is it possible to force Graph to make the app/SP visible to ARM immediately? Alternatively, is there a way in ARM to check if the app is visible, before I try creating my cluster?

4c74356b41 4c74356b41 · Accepted Answer · 2019-03-20T06:53:48

No, you just have to wait and retry, for example, I'm assigning permissions to AKS service principal to the ACR deployed alongside with AKS or to a pre-existing ACR. It will fail until service principal is recognized by ARM.

After that I start AKS deployment

Error creating AKS cluster in ARM with service principal in MS Graph

1 Answers