Service Principal - Remove keyCredential 403

[Daniel-SW]

Describe the bug 'v1.0/servicePrincipals/{servicePrincipal-id}/removeKey' does not seem to work. No combination of request body or permissions on Graph Explorer help.

Prerequisites

• keyCredential and passwordCredential were setup following Configure a custom signing key.
• The correct Permissions are given delegated and with admin consent as described in 'Modify Permissions'.

To Reproduce Steps to reproduce the behavior:

1. Go to 'https://developer.microsoft.com/en-us/graph/graph-explorer'
2. Enter POST, 'https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipal-id}/removeKey'
3. Add correct SP ID
4. Add a payload, such as example

   {
   "keyId": "f0b0b335-1d71-4883-8f98-567911bfdca6",
   "proof":"eyJ0eXAiOiJ..."
   }

5. All attempts and combinations return a 'Forbidden - 403'

Expected behavior The request completes with a 204 or some more specific error describing what is missing/wrong.

Additional context Additionally attempting to remove the passwordCredentail associated with the keyCredential results in a 500 error.

I see there is also a PowerShell command Remove-AzureADServicePrincipalKeyCredential, maybe this would work, it does not require a 'proof'.

[thewahome]

Since the call was successful but the results are unclear, it is likely an issue with the API. Please feel free to contact the appropriate team here: https://aka.ms/askgraph

[microsoft-github-policy-service[bot]]

Hello @Daniel-SW

Thank you for reporting your concern. Unfortunately, we in the Graph Explorer team do not have any ownership of the APIs that are causing you issues. If you report this issue in the Microsoft Q&A forum, it will get routed to the appropriate team for them to triage. https://aka.ms/askgraph This issue will now be closed. If you encounter any issues with Graph Explorer in the future, please feel free to open an issue.