Skip to content

Credential reset allows the use of weak passwords for Service Principals #20675

Description

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Describe the bug
When creating a service principal, the password by default is not allowed to be set by the end user in order to prevent weak passwords. However, this feature was not ported into the credential reset command and therefore weak passwords are still possible.

Documentation: https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli
image

To Reproduce
az ad sp credential reset --name "ResetClientSecret" --credential-description CliSecViaCLI --password ABC123
image

Expected behavior
Client Secret is not directly settable via CLI

Environment summary
image

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Type

No type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions