Resetting the app registration credentials with the sp object id does return a new password but does not save it

[TobiTh]

Describe the bug

When using the credential reset command on the sp level with the sp object id, the password gets not resetted. The CLI does return a new passord but the Azure Portal does not show it in the app registration.
The documentation does say that it works with the spObjectId, which it did for a while.

The credential reset does work with the appId or with the az ad app credential reset command with either the appObjectId or the appId.

Command Name
az ad sp credential reset

To Reproduce:

• $applicationId = az ad app create --display-name "TMP_APP" --query appId -o tsv --only-show-errors
• $spObjectId = az ad sp create --id $applicationId --query id -o tsv --only-show-errors
• az ad sp credential reset --id "$spObjectId" --display-name {} --query {} -o {} --only-show-errors

Expected Behavior

A new password gets shown and it is visible in the azure portal in the app registration.
The actual behaviour is that a new password gets shown, but it is not visible in the azure portal in the app registration.

Environment Summary

Windows-10-10.0.19044-SP0
Python 3.10.4
Installer: MSI

azure-cli 2.37.0 *

Extensions:
managementpartner 0.1.3

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

[yonzhan]

@jiasli for awareness

[danielwuff]

Facing same issue, reset not acting same after 2.37.0 when --name changed to -- id, customKeyIdentifier is not showing after 2.37.0 and reset is not working:

//2.36.0:

//2.37.0:

after 2.37.0

az ad sp credential reset --name '$SP_ID' --query password -o tsv

to renew the Service Principal secret, the command completes successfully and returns the password, but the secret is not renewed.

[JQUINONES82]

Issue is the same when generating new certificates.

@Azure:~$ az ad app credential reset --id xxxxxxxxxxxxxxxxxxxxxx --create-cert
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
"appId": "",
"fileWithCertAndPrivateKey": "/xxxxxxxxxx/tmphrn623of.pem",
"password": null,
"tenant": "xxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Azure AD is not updated.

[mthebridge]

This is still a problem a year later. What's the point of providing a useful command for refreshing credentials if it silently fails?

[mthebridge]

I think this is actually a duplicate of #23566. Resolution is to use az ad app ... rather than az ad sp ...

[jiasli]

@mthebridge is correct. This issue is a duplicate of #23566.

[jiasli]

@danielwuff, in AD Graph, customKeyIdentifier was used as the display name for passwordCredential, but in Microsoft Graph, it was deprecated:

https://learn.microsoft.com/en-us/graph/api/resources/passwordcredential?view=graph-rest-1.0

customKeyIdentifier Binary Do not use.

It was replaced by displayName:

displayName String Friendly name for the password. Optional.