[prerequisites] for the az ad sp

[AdimUser]

Is it possible to include the minimum AD privilege required to execute the commands

[yonzhan]

Jiashuo Li (@jiasli) for awareness

[jiasli]

Currently, az ad sp still calls AD Graph, which means it uses AD Graph permissions which is hard to be assigned using GUI (#19818).

If you do want to know,

• For delegated permission, it requires Application.ReadWrite.All
• For application permission, it requires Application.ReadWrite.OwnedBy, or Application.ReadWrite.All

We are currently migrating to Microsoft Graph (#12946), and in the future, it will call Create application and Create servicePrincipal API. You can find required permissions in those linked documents.

[MaddyMicrosoft]

The pre-migration Azure AD Graph permission requirements were answered above. Since then, az ad sp has migrated from Azure AD Graph to Microsoft Graph in Azure CLI 2.37.0, so the relevant prerequisites are now the Microsoft Graph permissions for the application and servicePrincipal APIs.

Closing this out as obsolete.