Write-Host "Adding permissions to key vault"
$objectId=(Get-AzDataFactoryV2 -ResourceGroupName $rgName -Name $adfName).Identity.PrincipalId
$appId = (Get-AzADServicePrincipal -ObjectId $objectId).ApplicationId
Write-Host "~### error empty appId =" $appId
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ServicePrincipalName $appId -PermissionsToSecrets Get
This script was executed from pipeline and the '$appId" is coming empty. But it works on cloud shell.
I suppose you did not grant the permission for the service principal of your Resource Manager service connection in the devops pipeline.
I can reproduce your issue with a service principal that has no permission to get service principals, no error message, but also no output, if you run the command in local, catch the request, you will find a 403 error.
But it works on cloud shell.
In cloud shell, it uses the credential of the user account which you logged into the cloud shell. If it works, it just means your user account has permission to get the service principal.
To fix the issue, navigate to the Azure Active Directory in the portal -> App registrations -> All applications -> find the application corresponding to the service connection, its name should be like organizationname-projectname-513f22f1-befd-xxxxxxcfe90f1. Then click it -> add the permission like the screenshots(Note: your user account need the admin role to click the Grant admin consent button, e.g. Global admin ).
After granting the permission, wait for a while, the service principal of the service connection will be able to get the service principal, the script should work fine.
Application Admin for some, but if the Service Principal has the same permissions as you or higher you will also need Privileged Role Admin. No need to elevate to Global Admin for this