Document --sdk-auth as deprecated

[devlead]

In #19949 we can read

--sdk-auth was there since Nov 14, 2017 (8346147 from #5217). Azure SDK is not consuming it anymore, so we marked it as deprecated in #19414.

Please simply forget about it and do not use it in any way.

Originally posted by Jiashuo Li (@jiasli) in #19949 (comment)

This has been/is used by many build systems, and it's still documented without any hint of being deprecated
on https://docs.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az_ad_sp_create_for_rbac

So think this needs to be clearly documented there, and what should be used instead with i.e. GitHub Action for Azure CLI which has this documented as their preferred way
https://github.com/Azure/cli#configure-azure-credentials-as-github-secret

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: e99d25ff-03e2-e015-37f4-a29b59ec50d4
• Version Independent ID: 1a8e88ed-72c7-fbe7-b0ad-68f23b3946cd
• Content: az ad sp
• Content Source: latest/docs-ref-autogen/ad/sp.yml
• Service: active-directory
• GitHub Login: Robert Outlaw (@rloutlaw)
• Microsoft Alias: routlaw

[jiasli]

This has been/is used by many build systems, and it's still documented without any hint of being deprecated
on https://docs.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az_ad_sp_create_for_rbac

This is actually a problem of the document: MicrosoftDocs/azure-docs-cli#2720.

So think this needs to be clearly documented there, and what should be used instead with i.e. GitHub Action for Azure CLI which has this documented as their preferred way
https://github.com/Azure/cli#configure-azure-credentials-as-github-secret

Usha N (@N-Usha), Kanchan Verma (@kaverma), perhaps you can help with the removal of --sdk-auth (Azure/github#152)?

[andersson09]

Just ran into this now. Also, how do we go about resetting a service principal credential? Running 'az ad sp credential reset' returns the non 'sdk-auth' format which does not work with GitHub actions.

[jiasli]

Dan (@andersson09), you may manually translate the result of az ad sp credential reset to what GitHub Action requires: clientId, clientSecret, etc.

[alexellis]

We were using the --sdk-auth flag to get a service account to create Virtual Machines on Azure. This flag is now marked as depreciated, but seems to continue to work, but doesn't have the valid permissions at that point.

Could someone point us at the suggested new syntax instead of --sdk-auth?

For reference: inlets/inletsctl#116

[jiasli]

Alex Ellis (@alexellis),

Could someone point us at the suggested new syntax instead of --sdk-auth?

You may simply use the original output without --sdk-auth. Is there any specific property in --sdk-auth's output that you require?

[smarlowucf]

Hi, I ran into this issue as well. The original output is missing subscription id. Given a service principal is tied to a subscription id and having that id is required to authorize against the Python SDK it's nice to have in the json credential file. Is this something that can be added to the original output before --sdk-auth is removed? Also, the key names all change which makes it harder to support both types. Is there a reason to not use the same key names?

I also ran into the issue with permissions disappearing. Previously a principal was created as a Contributor by default I assume. As it had permissions by default. Now it seems this is required as --role but this change is not communicated.

Additionally it would be nice to set explicit permissions such as:

Compute.Image.Contributor
Storage.Contributor

Is this something that's possible?

[smarlowucf]

I created a separate request related to the missing subscription id #21693