Create service principal programmatically in Azure Python API

Question

How can I, using the Azure Python API, create a full set of credentials that can later be used to start and deallocate all VMs in a named resource group, without any other permissions?

I have thoroughly researched the example code and both official and unofficial documentation, but I don't even know where to start...

I know I will need a tenant ID, client ID, client secret and subscription ID. Which of those can I make using an API, and how would I go about assigning roles to allow for starting/deallocating VMs of an existing resource group?

Sample code highly sought after, but will take any hint!

Answer 1

Your need the azure-graphrbac package to create a Service Principal:

• https://docs.microsoft.com/python/api/overview/azure/activedirectory

The closer to a sample might be this unittest:

• https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/graphrbac/azure-graphrbac/tests/test_graphrbac.py

For role and permissions, you need azure-mgmt-authorization:

• https://docs.microsoft.com/python/api/overview/azure/authorization

Best sample for this one, is probably the sub-part of this sample:

• https://github.com/Azure-Samples/compute-python-msi-vm#role-assignement-to-the-msi-credentials

"msi_identity" is a synonym of "service principal" in your context.

Note that all of this is supported by the CLI v2.0:

• https://docs.microsoft.com/cli/azure/ad/sp
• https://docs.microsoft.com/cli/azure/role/assignment

It might be interested to test the CLI in --debug mode and sniffing in the code repo at the same time:

• https://github.com/Azure/azure-cli

(full disclosure, I work at MS in the Azure SDK for Python team)