Search code examples
azure-active-directoryazure-keyvaultservice-principal

Service Principal added as unknown in keyvault access policy

I want to add Service Principal to Azure Keyvault access policies.

I tried with below command

Set-AzKeyVaultAccessPolicy -VaultName 'kvevalmock' -ObjectId '23erer-ed58-4ead-w34d-1ete23w3yofa' -PermissionsToSecrets @("get","list","set","delete","backup","restore","recover","purge") -PermissionsToKeys @("decrypt","encrypt","unwrapKey","wrapKey","verify","sign","get","list","update","create","import","delete","backup","restore","recover","purge") -BypassObjectIdValidation

Command gets executed but in keyvault access policies, Service principal is not listed in Application section. SP gets added as Unknown. Due to this issue, keyvault secrets creation throw forbidden access error.

enter image description here

Solution

  • For the parameter -ObjectId, you should provide object id of the service principal(enterprise app) but not the object id of the registered app.

    First go to your registered app, I guess you copy the object id in this page:

    enter image description here

    Click the "Managed application in local directory" which in red box in screenshot above to go to the service principal(enterprise app). And then copy the object of the app, use the object id in your command. enter image description here