how to create service principal

Question

hi friend,

i would like to create service principal for azcopy upload file from on-prem to azure storage account.

Does this service principal have to belong to the same subscription as storage account?

Answer 1

@Winston Huang

Thank you for your post and I apologize for the delayed response!

I understand that you're trying to create a Service Principal to upload files to an Azure Storage Account from on-prem using azcopy and would like to know if it's required for the Service Principal to belong to the same Subscription as the Storage Account. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

---

Findings:

Yes - when it comes to your Service Principal needing to belong to the same Subscription as the Storage Account, this is needed because the service principal needs to have the necessary permissions to access your storage account. If the service principal were to belong to a different subscription, it won't have the required permissions to access your storage account.

For more info:

1. Create an Azure Active Directory application and service principal that can access resources
2. Get started with AzCopy - Authorize a service principal

---

Additional Links:

• Authorize access to blobs with AzCopy and Azure Active Directory (Azure AD)
• Service principal object

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 2

Service principal is being created for a subscription with the rights to operate on the subcription with the following commands. So, the subscription parameter is important for the SP to be created for azcopy

az ad sp create-for-rbac  --name <service-principal> --role "Storage Blob Data Contributor" ` --scopes /subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>

az role assignment create --assignee "<appId>"  --role "Reader" --scope "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>"

---

--please don't forget to upvote and Accept as answer if the reply is helpful--