Can I use User Managed Identity to reset the Secret of a Service Principal?

Question

Hello, I would like to use a PowerShell runbook to automate the updating of a Service Principal password. Due to security concerns, I do not want to use an account without MFA to connect to Azure. Is it possible to achieve this?

Answer 1

Hello All,

In the end, I used the method of inviting a guest, creating a new account, and then inviting it to another Tenant. I controlled the account's properties using the system-assigned managed identity for an Azure Automation account. When it was necessary to update the Secret for the Microsoft Entra application, I would enable that account, and during regular times, I would keep it disabled.

After all, automation cannot log in with accounts that have MFA enabled, so I used this approach to prevent any security issues from arising.

Answer 2

永勝 施, thank you for posting this question on Microsoft Q&A.

You should be able to perform this operation using the user-managed identity. Please find below the high-level set of steps that needs to be taken to achieve this goal:

1. Create user managed identity and assign it to Azure Automation Account. For details, see Using a user-assigned managed identity for an Azure Automation account.
2. The main point to remember is to assign the role which has access to update the Service Principal. The Microsoft Entra (formerly known as Azure Active Directory) built-in roles are available here - Microsoft Entra built-in roles
3. Verify the role assignment to the user-managed identity.
4. For authentication, use the Connect-AzAccount -Identity -AccountId <user-assigned-identity-ClientId> cmdlet and parameter. For sample, see Authenticate access with user-assigned managed identity

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.