Azure / azure-cli

Azure Command-Line Interface
MIT License
4.04k stars 3.01k forks source link

`az ad app create` and `az ad sp create-for-rbac` should not be idempotent #30427

Open jiasli opened 6 days ago

jiasli commented 6 days ago

Related command az ad app create az ad sp create-for-rbac

Is your feature request related to a problem? Please describe. Derived from IcM 568027592

9108 made az ad app create and az ad sp create-for-rbac use displayName to uniquely identify an application. If an application with the specified displayName already exists, Azure CLI will PATCH it with the newly provided properties by calling Update application API. This API requires microsoft.directory/applications/basic/update permission that a user may not possess. The user may only have microsoft.directory/applications/createAsOwner and expect these commands to work.

This behavior is not aligned with the underlying Create application API where displayName is not used as a primary key and multiple applications can have the same displayName. Creating applications with the same displayName will create multiple applications.

Describe the solution you'd like Change this behavior to align with the underlying Create application API, PowerShell and Entra portal to eliminate possible confusions. In other words, the change will make calling az ad app create or az ad sp create-for-rbac multiple times create multiple applications with the same displayName.

Describe alternatives you've considered Explicitly document this behavior and define it as by-design.

Additional context

yonzhan commented 6 days ago

Thank you for opening this issue, we will look into it.