unable to delete service principal create by ai hub

Question

unable to delete service principal create by ai hub

Krzysztof Kawalec 0

A timeout occurred while setting up Azure AI Hub. Some of the resources were set up, but not all.

There is still e.g. Service Principal which I can not remove because I have no access (message in the portal).

All options to add permissions are inactive.

From cli also no access.

How can I remove such service princical?

Commad:

az rest --method POST --uri https://graph.microsoft.com/beta/servicePrincipals/{TARGET SP OBJECT ID}/owners/$ref --body '{"@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{OWNER SP OBJECT ID}"}'

1 answer

Your answer

Answer 1

Navya 17,820 Microsoft External Staff

Hi @Krzysztof Kawalec

I understand you are unable to delete service principal from portal and CLI.

Could you please confirm how the service principal was created? Try to delete the service principal using PowerShell

Install-Module -Name Microsoft.Entra -Repository PSGallery -Scope CurrentUser -Force -AllowClobber

Connect-Entra -Scopes 'Application.Read.All', 'Application.ReadWrite.OwnedBy'

Get-EntraServicePrincipal // This lists all service principals. Copy your service principal's application ID.

Get-EntraServicePrincipal -Filter "displayName eq '{replace your application name}'" | Remove-EntraServicePrincipal

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Krzysztof Kawalec 0 Reputation points

2025-03-24T07:40:27.4466667+00:00

Unfortunately I can't execute “Import-Module Microsoft.Graph” because of the error:

“Import-Module : Function Confirm-MgRiskyServicePrincipalCompromised cannot be created because function capacity 4096 has been exceeded for this scope.” (module names are different).

Windows 11 with updates.

Attempts to run “powershell -NoProfile” change nothing.
Maybe there is an alternative to Azure CLI?
Navya 17,820 Reputation points Microsoft External Staff

2025-03-25T02:11:06.5666667+00:00
Hi @Krzysztof Kawalec

Could you please try to execute below PowerShell script

Install-Module -Name Microsoft.Entra -Repository PSGallery -Scope CurrentUser -Force -AllowClobber Connect-Entra -Scopes 'Application.Read.All', 'Application.ReadWrite.OwnedBy' Get-EntraServicePrincipal // This lists all service principals. Copy your service principal's application ID. Get-EntraServicePrincipal -Filter "displayName eq '{replace your application name}'" | Remove-EntraServicePrincipal

To delete service principal, execute below command in Azure CLI

az ad sp delete --id 00000000-0000-0000-0000-000000000000

For your reference: https://learn.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-delete

If you are still facing issues and have global administrator permissions, you can leverage access to all subscriptions and management groups in your tenant.

To elevate access, please follow the documentation: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs and then try deleting the service principal from the portal.
Krzysztof Kawalec 0 Reputation points

2025-03-25T19:47:42.45+00:00

I have enabled "elevated access" but I still get the error "Insufficient privileges to complete the operation" (with az ad sp delete).

Powershell error:
PS C:\Users\user> Connect-Entra -Scopes 'Application.Read.All', 'Application.ReadWrite.OwnedBy' Connect-Entra : InteractiveBrowserCredential authentication failed: AADSTS650053: The application 'Microsoft Graph Command Line Tools' requested the scope 'Application.ReadWrite.OwnedBy' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the application vendor.

I tried to delete service account 'company-ai2-development-hub', this service account was created when creating a new Azure AI Foundry project (timed out).
Navya 17,820 Reputation points Microsoft External Staff

2025-03-26T08:19:52.5833333+00:00

Hi Krzysztof Kawalec

To perform actions on a service principal, you must have User Access Administrator or Role-Based Access Control (RBAC) Administrator permissions. Since you have elevated access, I believe you have the required permissions. Please try signing out and signing in again.

Could you please tell me how you created the service principal — through the portal or Azure CLI? Additionally, share the screenshot of the error you encountered when performing the az ad sp delete command.

Regarding the error "InteractiveBrowserCredential authentication failed: AADSTS650053", could you please confirm if you tried logging in with Global Admin privileges when running the PowerShell commands? You should be able to see the Admin consent request. If you have the Global Admin role, you should be able to accept consent for the permissions.
Navya 17,820 Reputation points Microsoft External Staff

2025-03-27T09:54:41.08+00:00

Hi Krzysztof Kawalec

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Navya 17,820 Reputation points Microsoft External Staff

2025-03-28T06:41:49.5633333+00:00

Hi Krzysztof Kawalec

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Krzysztof Kawalec 0 Reputation points

2025-04-08T11:37:14.5033333+00:00

I'm a global admin, so I believe I have all the necessary permissions.

I tried logging in and out, but nothing changed.

I created a service principal while setting up a new Azure Foundry IA in a region without available capacity. In the end, there was a timeout, and I was left with a blocked service principal.

could you please confirm if you tried logging in with Global Admin privileges when running the PowerShell commands?

Yes, I confirm.
SrideviM 2,455 Reputation points Microsoft External Staff

2025-04-09T01:34:34.27+00:00

Hello Krzysztof Kawalec,

Please check the private message window and share your available time zone so we can schedule a team's meeting to connect offline.
SrideviM 2,455 Reputation points Microsoft External Staff

2025-04-25T05:26:01.8333333+00:00

Hello Krzysztof Kawalec,

Thanks for sharing all the required details. We created an incident internally regarding this and it's still active, will share you the update soon!

Share via

unable to delete service principal create by ai hub

1 answer

Your answer