Update documentation regarding optional parameter --sdk-auth

[meierale]

I completely fail to understand what the following documentation is supposed to mean.

--sdk-auth
Output result in compatible with Azure SDK auth file.
accepted values: false, true

Please describe this in a customer tailored and understandable way, using proper English sentences. Thanks ;-)

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: e99d25ff-03e2-e015-37f4-a29b59ec50d4
• Version Independent ID: 1a8e88ed-72c7-fbe7-b0ad-68f23b3946cd
• Content: az ad sp
• Content Source: latest/docs-ref-autogen/ad/sp.yml
• Service: active-directory
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

@jiasli for awareness

[jiasli]

--sdk-auth was there since Nov 14, 2017 (8346147 from #5217). Azure SDK is not consuming it anymore, so we marked it as deprecated in #19414.

Please simply forget about it and do not use it in any way.

[meierale]

We removed --sdk-auth from the following command:
az ad sp create-for-rbac --name $spName --role $spRole --scopes $spScope --sdk-auth true ... but then we ran into the following error:
Cannot find user or service principal in graph database for 'null'. If the assignee is an appId, make sure the corresponding service principal is created with 'az ad sp create --id null'.

So somehow we can't just "not use it in anyway".

[jiasli]

--sdk-auth only controls the output format. It has nothing to do with the business logic.

The error message is thrown at:

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Lines 1810 to 1812 in 3c34079

	raise CLIError("Cannot find user or service principal in graph database for '{assignee}'. "
	"If the assignee is an appId, make sure the corresponding service principal is created "
	"with 'az ad sp create --id {assignee}'.".format(assignee=assignee))

Could you share the the full script you are using and the --debug log of the failed command?

[meierale]

thanks @jiasli for the info that --sdk-auth only influences the output. This lead us onto the right path and we could fix the error:

• it resulted from a consecutive az role assignment create command
• this uses the service principal id from the previous az ad sp create-for-rbac output
• when using --sdk-auth, the output contains a .clientId, otherwise the .appId hast to be used from the output.

Now that this is fixed we can completely ignore the --sdk-auth parameter as suggested 👍

[johndowns]

FYI, this parameter is used when working with GitHub Actions (and, presumably, other deployment pipelines). Is it possible to provide clear guidance on exactly what path customers should follow from now on?