calling ad sp credential list returns empty

When calling az ad sp credential list it returns empty value but after renewing a password for the first time it shows the correct value.

To Reproduce

Create a spn and then call

 az ad sp credential list --id {app id}

then renew a password for the spn and call the above command again

Expected behavior It should show the expiry date of spn before renewing the password.

After further investigation I noticed the command is calling below url: ‘https://graph.windows.net/tenant/applications/{objectid}/passwordCredentials?api-version=1.6’ which is the same url for az ad app credential.

It should call ‘https://graph.windows.net/tenant/serviceprincipals/{objectid}/passwordCredentials?api-version=1.6’

What’s more ,if url of serviceprincipal is called it doesn’t return the latest expiry date after renewing the password which is another issue.

azure-cli 2.32.0

[jiasli]

Azure Portal can only show app’s credential, not service principal’s. Use az ad app credential list to get the same behavior as Azure Portal.

[dosmanak]

Hello. I also get empty response on az ad sp credential list --id <<sp.appId>>.

When I search for the service principal in portal, I was able to found the expiry info and obfuscated secret under AAD->Apps Registrations->Certificates and Secrets

$ az version
Azure-cli    Azure-cli-core    Azure-cli-telemetry
-----------  ----------------  ---------------------
2.38.0       2.38.0            1.0.6

EDIT:

I was able to get the information using

az ad app show --id <<app.id>> -o json --query 'passwordCredentials[].endDateTime'

or

az ad app credential list --id <<app.id>>

Where id is to be found using

az ad app list --app-id <<sp.appId>> -o tsv --query '[].id'