Automating the creation of service principal in Azure in a customer account

Kanwaljeet Sachdev 1 Reputation point
2020-07-28T23:32:20.72+00:00

Here is a scenario. I have a SaaS product that needs to make api calls to customer's Azure cloud account. I understand a service principal can be created on the customer's AZ account, and if I have the credentials(app id, password, etc), I can make calls using that user/principal based on the permissions to that principal. One way is that customer creates it for my product, then comes to my product portal(web ui) and punches in this information which my SaaS product can then store securely in vault and use it.

Is there a better way to achieve the creation of the principal? For example via application manifest or something and then also be able to get a Event grid notification or something with the app/principal's creds to a webhook url endpoint?

Basically, I want this to be as automated as possible but cannot think of a way if it is even possible.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,696 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,326 Reputation points
    2020-07-29T20:49:41.97+00:00

    You can create a multi tenant application that will be used as template for the customers SPs and use the New-AzureADServicePrincipal cmdlet or MS Graph Create servicePrincipal operation to provisionate one in each customer tenant.