New-AzADSpCredential

Module:

Az.Resources Module

Adds a credential to an existing service principal.

Syntax

SpObjectIdWithPasswordParameterSet (Default)

New-AzADSpCredential
    -ObjectId <Guid>
    [-Password <SecureString>]
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SpObjectIdWithCertValueParameterSet

New-AzADSpCredential
    -ObjectId <Guid>
    -CertValue <String>
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SPNWithCertValueParameterSet

New-AzADSpCredential
    -ServicePrincipalName <String>
    -CertValue <String>
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SPNWithPasswordParameterSet

New-AzADSpCredential
    -ServicePrincipalName <String>
    [-Password <SecureString>]
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ServicePrincipalObjectWithCertValueParameterSet

New-AzADSpCredential
    -ServicePrincipalObject <PSADServicePrincipal>
    -CertValue <String>
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ServicePrincipalObjectWithPasswordParameterSet

New-AzADSpCredential
    -ServicePrincipalObject <PSADServicePrincipal>
    [-Password <SecureString>]
    [-StartDate <DateTime>]
    [-EndDate <DateTime>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

The New-AzADSpCredential cmdlet can be used to add a new credential or to roll credentials for a service principal. The service principal is identified by supplying either the object id or service principal name.

Examples

Example 1 - Create a new service principal credential using a generated password

PS C:\> New-AzADSpCredential -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb

Secret    : System.Security.SecureString
StartDate : 11/12/2018 9:36:05 PM
EndDate   : 11/12/2019 9:36:05 PM
KeyId     : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Type      : Password

A new password credential is added to the existing service principal with object id 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb'.

Example 2 - Create a new service principal credential using a certificate

PS C:\> $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate
PS C:\> $cer.Import("C:\myapp.cer")
PS C:\> $binCert = $cer.GetRawCertData()
PS C:\> $credValue = [System.Convert]::ToBase64String($binCert)
PS C:\> New-AzADSpCredential -ServicePrincipalName "http://test123" -CertValue $credValue -StartDate $cer.GetEffectiveDateString() -EndDate $cer.GetExpirationDateString()

The supplied base64 encoded public X509 certificate ("myapp.cer") is added to the existing service principal using its SPN.

Example 3 - Create a new service principal credential using piping

PS C:\> Get-AzADServicePrincipal -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb | New-AzADSpCredential

Secret    : System.Security.SecureString
StartDate : 11/12/2018 9:36:05 PM
EndDate   : 11/12/2019 9:36:05 PM
KeyId     : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Type      : Password

Gets the service principal with object id 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb' and pipes that to the New-AzADSpCredential to create a new service principal credential for that service principal with a generated password.

Parameters

-CertValue

The value of the "asymmetric" credential type. It represents the base 64 encoded certificate.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

SpObjectIdWithCertValueParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

SPNWithCertValueParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with azure

Parameter properties

Type:	IAzureContextContainer
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	AzContext, AzureCredential

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-EndDate

The effective end date of the credential usage. The default end date value is one year from today. For an "asymmetric" type credential, this must be set to on or before the date that the X509 certificate is valid.

Parameter properties

Type:	DateTime
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-ObjectId

The object id of the service principal to add the credentials to.

Parameter properties

Type:	Guid
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	ServicePrincipalObjectId

Parameter sets

SpObjectIdWithPasswordParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

SpObjectIdWithCertValueParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Password

The password to be associated with the application.

Parameter properties

Type:	SecureString
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

SpObjectIdWithPasswordParameterSet

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

SPNWithPasswordParameterSet

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-ServicePrincipalName

The name (SPN) of the service principal to add the credentials to.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	SPN

Parameter sets

SPNWithCertValueParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

SPNWithPasswordParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-ServicePrincipalObject

The service principal object to add the credentials to.

Parameter properties

Type:	PSADServicePrincipal
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ServicePrincipalObjectWithCertValueParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

ServicePrincipalObjectWithPasswordParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-StartDate

The effective start date of the credential usage. The default start date value is today. For an "asymmetric" type credential, this must be set to on or after the date that the X509 certificate is valid from.

Parameter properties

Type:	DateTime
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

Guid

String

PSADServicePrincipal

Parameters: ServicePrincipalObject (ByValue)

SecureString

DateTime

Outputs

PSADCredential

Microsoft.Azure.Commands.Resources.Models.Authorization.PSADCredentialWrapper

Related Links

• Get-AzADSpCredential
• Remove-AzADSpCredential
• Get-AzADServicePrincipal