Service principal setup

Use this script to create a service principal (app registration) in Microsoft Entra ID for use with Turbo360's Cost Analyzer module. After running this script, apply the required permissions using the scripts documented in the other pages in this section.

Before running the script

1. Confirm you have Global Admin permissions in your Azure tenant.

2. Sign in to the Azure CLI and obtain a Microsoft Graph API-scoped token using the following command.

az login --use-device-code  --scope https://graph.microsoft.com//.default --tenant [Tenant ID]

3. Save the full script from the Script section below to a location you can run it from.

4. Run the script using the following command.

.\Setup-ServicePrincipal.ps1 -AppName "Turbo360-CostAnalyzer"

Script

The script creates an Entra app registration with a service principal and client secret, then outputs the Tenant ID, Client ID, and Client Secret. Store the Client Secret securely — it cannot be retrieved again after the script completes.

# Creates an Entra App Registration with a Service Principal and client secret,
# then outputs the Tenant ID, Client ID, and Client Secret.
#
# Prerequisites:
#   az login --use-device-code --scope https://graph.microsoft.com//.default --tenant [Tenant ID]
#
# Usage:
#   .\Setup-ServicePrincipal.ps1 -AppName "my-app-name"
#   .\Setup-ServicePrincipal.ps1 -AppName "my-app-name" -SecretExpiryYears 2

param(
    [Parameter(Mandatory = $true)]
    [string]$AppName,

    [Parameter(Mandatory = $false)]
    [int]$SecretExpiryYears = 2
)

# Create the App Registration
Write-Host "Creating App Registration '$AppName' ..."
$App = az ad app create --display-name $AppName --query "{appId:appId, id:id}" -o json | ConvertFrom-Json

if (-not $App) {
    Write-Error "Failed to create App Registration."
    exit 1
}

$ClientId = $App.appId
$AppObjectId = $App.id
Write-Host "App Registration created. Client ID: $ClientId"

# Create the Service Principal for the App Registration
Write-Host "Creating Service Principal ..."
az ad sp create --id $ClientId | Out-Null

# Create a client secret
Write-Host "Creating client secret (expires in $SecretExpiryYears year(s)) ..."
$EndDate = (Get-Date).AddYears($SecretExpiryYears).ToString("yyyy-MM-dd")
$Secret = az ad app credential reset --id $AppObjectId --end-date $EndDate --query "{secretText:secretText, password:password}" -o json | ConvertFrom-Json

if (-not $Secret) {
    Write-Error "Failed to create client secret."
    exit 1
}

$ClientSecret = if ($Secret.secretText) { $Secret.secretText } else { $Secret.password }

# Get the Tenant ID
$TenantId = az account show --query tenantId -o tsv

# Output the details
Write-Host ""
Write-Host "============================================"
Write-Host "App Registration Details"
Write-Host "============================================"
Write-Host "Display Name  : $AppName"
Write-Host "Tenant ID     : $TenantId"
Write-Host "Client ID     : $ClientId"
Write-Host "Client Secret : $ClientSecret"
Write-Host "Secret Expiry : $EndDate"
Write-Host "============================================"
Write-Host "NOTE: Store the Client Secret securely - it cannot be retrieved again."