Script to Setup Service Principal

This script will help you create a Service Principal / App Registration to use in Turbo360 with the Cost Analyzer module.  This page will help create the script.  You will then need to apply permissions which are covered by scripts in other pages in this document.

Before Running the Script

1. Make sure you have elevated permissions  for Global Admin

2. Log into Azure CLI and get a Microsoft Graph API scoped token with the below command

az login --use-device-code  --scope https://graph.microsoft.com//.default --tenant [Tenant ID]

3. Save the below full script somewhere you can run it from

4. Run the script like this

.\Setup-ServicePrincipal.ps1 -AppName "Turbo360-CostAnalyzer"

Script

# Creates an Entra App Registration with a Service Principal and client secret,
# then outputs the Tenant ID, Client ID, and Client Secret.
#
# Prerequisites:
#   az login --use-device-code --scope https://graph.microsoft.com//.default --tenant [Tenant ID]
#
# Usage:
#   .\Setup-ServicePrincipal.ps1 -AppName "my-app-name"
#   .\Setup-ServicePrincipal.ps1 -AppName "my-app-name" -SecretExpiryYears 2

param(
    [Parameter(Mandatory = $true)]
    [string]$AppName,

    [Parameter(Mandatory = $false)]
    [int]$SecretExpiryYears = 2
)

# Create the App Registration
Write-Host "Creating App Registration '$AppName' ..."
$App = az ad app create --display-name $AppName --query "{appId:appId, id:id}" -o json | ConvertFrom-Json

if (-not $App) {
    Write-Error "Failed to create App Registration."
    exit 1
}

$ClientId = $App.appId
$AppObjectId = $App.id
Write-Host "App Registration created. Client ID: $ClientId"

# Create the Service Principal for the App Registration
Write-Host "Creating Service Principal ..."
az ad sp create --id $ClientId | Out-Null

# Create a client secret
Write-Host "Creating client secret (expires in $SecretExpiryYears year(s)) ..."
$EndDate = (Get-Date).AddYears($SecretExpiryYears).ToString("yyyy-MM-dd")
$Secret = az ad app credential reset --id $AppObjectId --end-date $EndDate --query "{secretText:secretText, password:password}" -o json | ConvertFrom-Json

if (-not $Secret) {
    Write-Error "Failed to create client secret."
    exit 1
}

$ClientSecret = if ($Secret.secretText) { $Secret.secretText } else { $Secret.password }

# Get the Tenant ID
$TenantId = az account show --query tenantId -o tsv

# Output the details
Write-Host ""
Write-Host "============================================"
Write-Host "App Registration Details"
Write-Host "============================================"
Write-Host "Display Name  : $AppName"
Write-Host "Tenant ID     : $TenantId"
Write-Host "Client ID     : $ClientId"
Write-Host "Client Secret : $ClientSecret"
Write-Host "Secret Expiry : $EndDate"
Write-Host "============================================"
Write-Host "NOTE: Store the Client Secret securely - it cannot be retrieved again."