How to get thumbprint of the cert associated with a service principal in AzureAD when the sp is created independently without App and Cred

Question

I have a service principal that I've creating using below powershell.

$sp3 = New-AzureRmADServicePrincipal `
    -DisplayName "<service-principal-name>" `
    -CertValue $certValue3 `
    -EndDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert3.Certificate.GetExpirationDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time'))

where certValue3 is Base64String RawCertData. This service principal works fine and I am able to get a token when using the cert.

Once service principal is created in Azure AD, how do I see thumbprint of the certificate associated with the service principal using Powershell?

I've tried this, but I get Forbidden when I try to execute Get-AzureADApplicationKeyCredential

I also checked the manifest in Azure Portal under the service principal that gets created under Azure Active Directory → App Registrations → <service-principal-name> → Manifest, but the keyCredentials node is empty

"keyCredentials": [],

Please note that when I create an application using New-AzureRmADApplication followed by credential New-AzureRmADAppCredential and then New-AzureRmADServicePrincipal, then I see the keyCredentials with customKeyIdentifier set to the certificate thumbprint. Sample script below -

$adapp = New-AzureRmADApplication -DisplayName "<application-name>" `
    -HomePage "<home-page-url>" `
    -IdentifierUris "<identifier-url>" `
    -CertValue $certValue `
    -StartDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert.Certificate.GetEffectiveDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time')) `
    -EndDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert.Certificate.GetExpirationDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time'))

New-AzureRmADAppCredential -ApplicationId $adapp.ApplicationId -CertValue $certValue2 

$sp2 = New-AzureRmADServicePrincipal -ApplicationId $adapp.ApplicationId -DisplayName "<application-name>"

How to get thumbprint of the certificate associated with a service principal in Azure AD using powershell when the service principal is created independently without AzureRmADApplication and AzureRmADAppCredential?

Ooh that's interesting. Have you tried checking the SP object via e.g. the Graph Explorer? Https://aka.ms/ge — juunas
@juunas, yes, although i couldn't get Graph Explorer to work. I always get an empty list of applications when I invoke it. So I cannot dig further down for a specific application. :/ — perf-guru
Did you try to get /servicePrincipals/the-objectId-from-first-command? I mean the PowerShell command should tell you the id — juunas
yes, https://graph.microsoft.com/beta/serviceprincipals/ also gives me empty list :(. Only place I can see information (or the absence of it) is on the Manifest page. — perf-guru

Jim Xu Jim Xu · Accepted Answer · 2020-02-06T01:02:35

According to my test, we can use the following Azure AD Graph API to get the key credentials of the sp. The customKeyIdentifier in KeyCredential is the thumbprint of the certificate

GET https://graph.windows.net/<your teanant id>/servicePrincipals/<your sp object id>/keyCredentials?api-version=1.6

For example

Create sp and get thumbprint

$tenantId ="<tenant id>"
#use the goabl admin account to login 
Connect-AzureRmAccount -Tenant $tenantId

$certificateObject = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$certificateObject.Import("E:\Cert\examplecert.pfx","Password0123!", [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet)
Write-Host "the thumbrint of cert"
$certificateObject.Thumbprint

$keyValue = [System.Convert]::ToBase64String($certificateObject.GetRawCertData())

$sp =New-AzureRmADServicePrincipal -DisplayName "jimtestsample" -CertValue $keyValue -EndDate $endDate
$context=Get-AzureRmContext
$token=$context.TokenCache.ReadItems() |Where-Object { ($_.TenantId -eq $tenantId) -and ($_.Resource -eq "https://graph.windows.net/")  }
$accesstoken=$token.AccessToken

$url = "https://graph.windows.net/$tenantId/servicePrincipals/"+$sp.Id+"/keyCredentials?api-version=1.6"

$keyCreds = Invoke-RestMethod -Uri $url  -Method Get -Headers @{"Authorization" = "Bearer $accesstoken"}
Write-Host "--------------------------------------------"
$keyCreds.value | Select-Object customKeyIdentifier

How to get thumbprint of the cert associated with a service principal in AzureAD when the sp is created independently without App and Cred

2 Answers