service-endpoint create returns successful but built an invalid service endpoint

Describe the bug

When creating a service endpoint to connect Azure DevOps to an Azure Container Registry, and choosing the Service Principal method of authentication, the service endpoint is created, but the Service Principal no longer is. This results in an un-usable service endpoint with a misleading error about an invalid refresh token, when in fact the service principal ID is listed as "" when the show command is run.

Related command

az devops service-endpoint create --service-endpoint-configuration ACR_ServiceConnection.json --organization https://dev.azure.com/myorg/ --project 00000000-0000-0000-0000-000000000000

Errors

When az devops service-endpoint show is run, this is the output (note the value of "servicePrincipalId" and the "statusMessage").

{ "administratorsGroup": null, "authorization": { "parameters": { "loginServer": "mytestcontainerregistry.azurecr.io", "role": "8311e382-0749-4cb8-b61a-304f252e45ec", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mytest_resource_group/providers/Microsoft.ContainerRegistry/registries/mytestcontainerregistry", "servicePrincipalId": "", "tenantId": "00000000-0000-0000-0000-000000000000" }, "scheme": "ServicePrincipal" }, "createdBy": { "descriptor": "aadsp.xxxx", "directoryAlias": null, "displayName": "myorg-myProject-00000000-0000-0000-0000-000000000000", "id": "3f4e0384-f1f6-6e49-af14-8bf052ae0ec4", "imageUrl": "https://dev.azure.com/myorg/_apis/GraphProfile/MemberAvatars/aadsp.xxxx", "inactive": null, "isAadIdentity": null, "isContainer": null, "isDeletedInOrigin": null, "profileUrl": null, "uniqueName": "b9994448-ecb9-46df-8c80-3a06a170c59e\a714afe3-2e47-4069-9b2d-db5b12daeeff", "url": "https://spsprodcus5.vssps.visualstudio.com/Ad59d1ca2-d9e8-4d4f-9f1f-49aeb8907c56/_apis/Identities/3f4e0384-f1f6-6e49-af14-8bf052ae0ec4" }, "data": { "appObjectId": "", "azureSpnPermissions": "", "azureSpnRoleAssignmentId": "", "registryId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mytest_resource_group/providers/Microsoft.ContainerRegistry/registries/mytestcloudcontainerregistry", "registrytype": "ACR", "spnObjectId": "", "subscriptionId": "00000000-0000-0000-0000-000000000000", "subscriptionName": "My_Subscription" }, "description": "", "groupScopeId": null, "id": "7de3f1c5-1897-4366-b0c4-ad862ec90820", "isOutdated": false, "isReady": false, "isShared": false, "name": "mytestcontainerregistryserviceconnection", "operationStatus": { "severity": null, "state": "Failed", "statusMessage": "A valid refresh token for identity 3f4e0384-f1f6-7e49-af14-8bf052ae0ec4 was not found." }, "owner": "Library", "readersGroup": null, "serviceEndpointProjectReferences": [ { "description": "", "name": "mytestcloudcontainerregistryserviceconnection", "projectReference": { "id": "00000000-0000-0000-0000-000000000000", "name": "MyProject" } } ], "type": "dockerregistry", "url": "https://hub.docker.com/" }

Issue script & Debug output

Expected behavior

A valid, usable service connection should be created, along with a new service principal which is associated with it.

Environment Summary

azure-cli 2.56.0 *

core 2.56.0 * telemetry 1.1.0

Extensions: azure-devops 0.26.0

Dependencies: msal 1.24.0b2 azure-mgmt-resource 23.1.0b2

Python location '/opt/az/bin/python3' Extensions directory '/opt/az/azcliextensions'

Python (Linux) 3.11.5 (main, Jan 8 2024, 09:08:13) [GCC 11.4.0]

Additional context

The 'create' should fail if it is unable to create a working service connection. I have tried using my administrative credentials, and the command line fails the same way there as well. When I use the web interface (dev.azure.com) I am able to successfully create the ACR service connection. I have also confirmed that the json file provided to the command line matches the json data submitted when I use the web interface.

Azure / azure-cli-extensions