Activation of Service Principal as Account Owner in the EA Portal via Powershell?

user_11663306 0
Viewed 264

Our customer wants to use a service principal to generate new subscriptions, so that a malicious employee doesn't have owner access to newly created subscriptions. I already generated a service principal via CLI, but to make him an account owner in the ea-portal the principal needs an e-mailaddress which is of course not existing. I cannot make that service principal an account owner

I already tried to implement to scenario based on the following docs.microsoft.com-entries:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/programmatically-create-subscription?tabs=azure-powershell

https://docs.microsoft.com/en-us/azure/azure-resource-manager/grant-access-to-create-subscription?tabs=rest%2Crest-2

The generation of the service principal was done with:

az ad sp create-for-rbac --name %name_of_the_account%

azure command-line-interface powershell
2 Answers

You don't need an eMail address. An existing account owner under the enrollment must grant the service principal (SP) the "SubscriptionCreator" role.

Step one after the creation of a SP is assigning said role to the SP. Use the REST API as described here, the existing account owner can log in directly on this page and send the request. You need to set a few properties as described here, the billingRoleAssignmentName among others which is a0bcee42-bf30-4d1b-926a-48d21664ef71 for the "SubscriptionCreator" role. In the HTTP body you define which SP will get these rights by specifying the principalId and principalTenantId property.

Afterwards, the SP can create subscriptions under the enrollment programmatically, see here for details.

user_46105140
user_105718550
Related