---
title: "How to Create Azure Service Principals in PowerShell"
description: "Learn how to create Azure service principals using PowerShell, enabling secure automation for managing Azure resources like virtual machines."
canonical: "https://adamtheautomator.com/powershell-service-principals/"
---

# How to Create Azure Service Principals in PowerShell

> Learn how to create Azure service principals using PowerShell, enabling secure automation for managing Azure resources like virtual machines.

Source: https://adamtheautomator.com/powershell-service-principals/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![How to Create Azure Service Principals in PowerShell](https://adamtheautomator.com/wp-content/uploads/2024/09/edab50b1-3d77-415f-92b8-7e487a332ac2.webp)

# How to Create Azure Service Principals in PowerShell

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)30 September 20242 min. read

Categories: [Cloud](/category/cloud/)

Tags:[Azure](/tag/azure/)[Azure PowerShell](/tag/azure-powershell/)[PowerShell](/tag/powershell/)

Table of Contents

*   [Step 1: Install Required Azure Modules](#step-1-install-required-azure-modules)
*   [Step 2: Create an Azure AD Application](#step-2-create-an-azure-ad-application)
*   [Step 3: Create a Service Principal](#step-3-create-a-service-principal)
*   [Step 4: Generate a Client Secret](#step-4-generate-a-client-secret)
*   [Step 5: Assign Permissions to the Service Principal](#step-5-assign-permissions-to-the-service-principal)
*   [Step 6: Authenticate Using the Service Principal](#step-6-authenticate-using-the-service-principal)
*   [Step 7: Test the Authentication](#step-7-test-the-authentication)
*   [Step 8: Rotate Client Secrets](#step-8-rotate-client-secrets)
*   [Conclusion](#conclusion)

In this blog post, you’ll learn how to create an Azure service principal using PowerShell, which is essential for automating tasks and securely managing resources in Azure. We will walk through the process of creating an Azure Active Directory (AD) application, generating a client secret, and assigning the necessary permissions for managing virtual machines (VMs). This method allows applications to securely authenticate and interact with Azure resources.

### Step 1: Install Required Azure Modules

Start by installing the necessary module, \`Az.Resources\`, which contains the cmdlets required to manage Azure resources, including creating and managing Azure AD applications and service principals.

```
Install-Module -Name Az.Resources
```

### Step 2: Create an Azure AD Application

Now, create an Azure AD application, which acts as the identity for managing Azure resources. Here, we create an app called “VMManagement” that will be used for managing virtual machines.

```
$vmManagementApp = New-AzADApplication -DisplayName VMManagement
```

### Step 3: Create a Service Principal

After creating the Azure AD application, generate a service principal. This principal allows us to manage resources in Azure using the app’s identity.

```
$sp = New-AzADServicePrincipal -ApplicationId $vmManagementApp.AppId
```

### Step 4: Generate a Client Secret

We now need to create a client secret that the service principal will use for authentication. This secret is generated and stored securely.

```
$clientSecret = New-AzADAppCredential -ObjectId $vmManagementApp.Id
$clientSecret.SecretText | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | Out-File -FilePath C:\AzureAppPassword.txt
```

This command creates a client secret for the app and saves it in an encrypted format to a file. This file will be used later to authenticate the application.

### Step 5: Assign Permissions to the Service Principal

The next step is to assign the necessary roles to the service principal. In this case, we grant the “Virtual Machine Contributor” role, allowing the service principal to manage VMs.

```
$subscriptionId = (Get-AzSubscription).Id
New-AzRoleAssignment -ObjectId $sp.Id -RoleDefinitionName "Virtual Machine Contributor" -Scope "/subscriptions/$subscriptionId"
```

This grants the service principal permissions to manage VMs in the specified subscription.

### Step 6: Authenticate Using the Service Principal

To test the authentication, use the client secret stored earlier to log in with the service principal.

```
$pass = (Get-Content -Path 'C:\AzureAppPassword.txt' | ConvertTo-SecureString)
$azureAppCred = New-Object System.Management.Automation.PSCredential($vmManagementApp.AppId, $pass)
$subscription = Get-AzSubscription
Connect-AzAccount -ServicePrincipal -SubscriptionId $subscription.Id -TenantId $subscription.TenantId -Credential $azureAppCred
```

This command authenticates the service principal using the application ID and the secure password.

### Step 7: Test the Authentication

Now that you’ve authenticated, test the authentication by retrieving a list of virtual machines in the subscription.

```
Get-AzVM
```

If successful, the command will return a list of VMs, confirming that the service principal is working as expected.

### Step 8: Rotate Client Secrets

For security, it’s essential to periodically rotate client secrets. The script below automates this process, generating a new client secret and removing the old one.

```
[CmdletBinding()]
param(
    [Parameter(Mandatory)]
    [string]$AdApplicationName,

    [Parameter()]
    [string]$OutputFilePath = "C:\NewAzureAppPassword.txt"
)

$adApp = Get-AzADApplication -DisplayName $AdApplicationName
$sp = Get-AzADServicePrincipal -ApplicationId $adApp.AppId
$newClientSecret = New-AzADAppCredential -ObjectId $adApp.Id
$newClientSecret.SecretText | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | Out-File -FilePath $OutputFilePath

$oldClientSecret = (Get-AzADApplication -DisplayName $AdApplicationName).PasswordCredentials | Sort-Object StartDateTime | select -First 1
Remove-AzADAppCredential -ApplicationId $adApp.AppId -KeyId $oldClientSecret.KeyId
```

This script rotates the client secret, generating a new one and securely saving it to a file.

### Conclusion

By following these steps, you’ve successfully created a service principal, granted it the necessary permissions, authenticated using the client secret, and tested it. Additionally, you’ve implemented a process to rotate client secrets regularly, enhancing the security of your Azure applications. This setup ensures your automation scripts can securely access and manage Azure resources without manual intervention.

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-service-principals%2F&text=How%20to%20Create%20Azure%20Service%20Principals%20in%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-service-principals%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-service-principals%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2024/09/DALL·E-2024-09-28-09.26.52-A-simple-image-representing-cloud-automation-in-Azure.-A-cloud-icon-with-gears-inside-a-server-and-a-command-prompt-symbol-all-connected-with-lines.webp)

### [Automating VM Deployment in Azure with PowerShell](/automating-azure-vm/)

Learn how to automate the deployment of a Windows VM on Azure using PowerShell. This guide covers network setup, NSG rules, and IIS installation.

![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-3.webp)

### [Build an Azure Home Lab for Certs Without Overspending](/azure-home-lab-certification-practice/)

Build a nested Azure Hyper-V home lab with budget alerts, a domain controller, and Azure Arc mapped to AZ-900, AZ-104, and AZ-305 exams.

![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-15.webp)

### [Fix Azure Cost Reporting with a FinOps Tagging Strategy](/fix-azure-cost-reporting-finops-tagging-strategy-3/)

Build an Azure resource tagging taxonomy, enforce it with Azure Policy, and automate remediation of untagged resources to enable accurate FinOps cost allocation and chargebacks.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)