And, if used with automation, a service account is most likely excluded from any conditional access policies or multi-factor authentication. And most admins probably use a fully privileged user account (called a service account) to set up the credential requirements for scripts.Ī service account is essentially a privileged user account used to authenticate using a username and password. Like, provisioning storage accounts or starting and stopping virtual machines at a schedule. Service AccountĪutomation tools and scripts often need admin or privileged access.

The Azure PowerShell module must be installed.Īzure Service Principal vs.

Access to a computer that is running on Windows 10 with PowerShell 5.1.

If you don’t have one, you could register for a free trial. It would be best if you’re working on a test tenant. Since this is a learning-by-doing article, here are some prerequisites so you can follow along. Still interested? Keep on reading and let’s get started! The tool that will be the focus of this article is the Azure PowerShell. These include using the Azure Portal, Azure Active Directory Admin Center, Azure AD PowerShell, Azure CLI, and Azure PowerShell. There are many tools to create Azure Service Principals. You’ll learn how to create service principals with different types of credentials, such as passwords, secret keys, and certificates. In this article, you’ll learn about what Azure Service Principal is. Of course, it is! And for sure, your IT Sec will give you a lot of grief if you did all that.īut what’s the alternative? How can you use a privileged credential with a limited scope that doesn’t have to be excluded from multi-factor authentication? You’re in luck because that’s what this article will teach you.

I know what you’re thinking – “that is a horrible idea”. When you need to automate tasks in Azure with scripts and tools, would you consider using service accounts or Azure service principals? It is not uncommon for some to just create a new service account, slap it with all the admin roles you want, and exclude it from MFA.

Connecting to Azure with a Service Principal Certificate.

Creating the Service Principal with Certificate.

Getting the ID of the Target Scope (Subscription).

Creating an Azure Service Principal with Certificate.

Connecting to Azure with a Service Principal Password.

Creating the Service Principal with Password.

Creating the Password Credential Object.

Getting the ID of the Target Scope (Resource Group).

Creating an Azure Service Principal with Password.

Verifying the Azure Service Principal Role Assignment.

Creating the Azure Service Principal with Secret Key.

Getting the ID of the Target Scope (Virtual Machine).

Creating an Azure Service Principal with Automatically Assigned Secret Key.

Primary Considerations for Creating Azure Service Principals.

Principle app license key