New-AzAdServicePrincipal does not process all input parameters

[strat-alex]

Description

The New-AzAdServicePrincipal documentation lists several parameters, like -AppRoleAssignmentRequired, which should do the following:
Specifies whether users or other service principals need to be granted an app role assignment for this service principal before users can sign in or apps can get tokens.

When trying a command like:
New-AzADServicePrincipal -AppRoleAssignmentRequired

the following error is shown:
New-AzADServicePrincipal: A parameter cannot be found that matches parameter name 'AppRoleAssignmentRequired'.

When looking at the powershell code in Az.MsGraph\New-AzAdServicePrincipal.ps1, the script first creates an AzAdApplication with the current set of $PSBoundParameters. Once the app is created, it tries to create a service principal with a limited set of parameters: AppId & AccountEnabled.

This also ignores the -accountenabled switch that is also documented.

I think this is the the code that actually makes the service principal

    $param = @{'AppId' = $PSBoundParameters['ApplicationId']; 'AccountEnabled'=$true; }
    if ($PSBoundParameters['Debug']) {
      $param['Debug'] = $PSBoundParameters['Debug']
    }
    $sp = Az.MSGraph.internal\New-AzADServicePrincipal @param

It's my first time navigating this code, I hope I didn't overlook or misinterpret anything.

But it seems the implementation is only partially done?

Issue script & Debug output

New-AzADServicePrincipal -AppRoleAssignmentRequired

Environment data

Name                           Value
----                           -----
PSVersion                      7.2.1
PSEdition                      Core
GitCommitId                    7.2.1
OS                             Microsoft Windows 10.0.22000
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.7.1                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script     5.2.0                 Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}

Error output

Message        : A parameter cannot be found that matches parameter name 'AppRoleAssignmentRequired'.
StackTrace     :    at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
                    at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
                    at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
                    at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
                    at System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame)
                    at System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0)
                    at System.Management.Automation.PSScriptCmdlet.RunClause(Action`1 clause, Object dollarUnderbar, Object inputToProcess)
                    at System.Management.Automation.PSScriptCmdlet.DoProcessRecord()
                    at System.Management.Automation.CommandProcessor.ProcessRecord()
Exception      : System.Management.Automation.ParameterBindingException
InvocationInfo : {New-AzADApplication}
Line           :       $app = New-AzADApplication @PSBoundParameters

Position       : At C:\Users\...\PowerShell\Modules\Az.Resources\5.2.0\MSGraph.Autorest\custom\New-AzADServicePrincipal.ps1:741 char:34
                 +       $app = New-AzADApplication @PSBoundParameters
                 +                                  ~~~~~~~~~~~~~~~~~~
HistoryId      : 19

[dingmeng-xue]

@VeryEarly , please help to look into it.

[VeryEarly]

Hi @alexv-be ,

The limited parameters for creating service principal is to align with older version of New-AzADServicePrincipal (using AAD API and not switch to Microsoft Graph API), we plan to enable other optional parameters soon in the near future.

Thanks

[strat-alex]

Thanks for the follow up!
I lost quite some time figuring out what works and doesn't work in both Add-AzADApplication and Add-AzADServicePrincipal. Having more in the documentation than actually works is not really helpful.

The breaking changes notice is in the documentation, why not add a notice that it's only partially implemented? A "use at your own risk" kind of thing?
Is the work planned or is it still in limbo? I'd like to figure out when I need to revisit these scripts to be working with the Az.Resources module. I'll keep an eye on the change notes in any case.

[VeryEarly]

Hi @alexv-be , fix will be available early next month.

[strat-alex]

thank you!