Service Principals - Create

Reference

Service:: Graph

API Version:: 7.1-preview.1

Materialize an existing AAD service principal into the ADO account.

NOTE: Created service principals are not active in an account.

Adding a service principal to an account is required before the service principal can be added to ADO groups or assigned an asset.

The body of the request must be a derived type of GraphServicePrincipalCreationContext:

GraphServicePrincipalOriginIdCreationContext - Create a new service principal using the OriginID as a reference to an existing service principal from AAD backed provider.

If the service principal to be added corresponds to a service principal that was previously deleted, then that service principal will be restored.

Optionally, you can add the newly created service principal as a member of an existing ADO group and/or specify a custom storage key for the service principal.

POST https://vssps.dev.azure.com/{organization}/_apis/graph/serviceprincipals?api-version=7.1-preview.1

With optional parameters:

POST https://vssps.dev.azure.com/{organization}/_apis/graph/serviceprincipals?groupDescriptors={groupDescriptors}&api-version=7.1-preview.1

URI Parameters

Name	In	Required	Type	Description
organization	path	True	string	The name of the Azure DevOps organization.
api-version	query	True	string	Version of the API to use. This should be set to '7.1-preview.1' to use this version of the api.
groupDescriptors	query		string array (string)	A comma separated list of descriptors of groups you want the graph service principal to join

Request Body

Name	Type	Description
storageKey	string	Optional: If provided, we will use this identifier for the storage key of the created service principal

Responses

Name	Type	Description
200 OK	GraphServicePrincipal	successful operation

Security

oauth2

Type: oauth2
Flow: accessCode
Authorization URL: https://app.vssps.visualstudio.com/oauth2/authorize&response_type=Assertion
Token URL: https://app.vssps.visualstudio.com/oauth2/token?client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

Scopes

Name	Description
vso.graph_manage	Grants the ability to read user, group, scope and group membership information, and to add users, groups and manage group memberships

Examples

Sample request

HTTP

POST https://vssps.dev.azure.com/{organization}/_apis/graph/serviceprincipals?api-version=7.1-preview.1

{
  "originId": "053b9e43-b344-4d53-897f-fe5d9c016625"
}

Sample response

Status code:: 201

{
  "subjectKind": "servicePrincipal",
  "applicationId": "7adff1a5-9d3f-407d-8b79-4dd547d472b1",
  "directoryAlias": "053b9e43-b344-4d53-897f-fe5d9c016625",
  "domain": "62e2ee3f-dbd4-48d8-9b85-4a3776783e13",
  "principalName": "053b9e43-b344-4d53-897f-fe5d9c016625",
  "mailAddress": null,
  "origin": "aad",
  "originId": "053b9e43-b344-4d53-897f-fe5d9c016625",
  "displayName": "ServicePrincipalDisplayName",
  "_links": {
    "self": {
      "href": "https://vssps.dev.azure.com/Fabrikam/_apis/Graph/ServicePrincipals/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
    },
    "memberships": {
      "href": "https://vssps.dev.azure.com/Fabrikam/_apis/Graph/Memberships/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
    },
    "membershipState": {
      "href": "https://vssps.dev.azure.com/Fabrikam/_apis/Graph/MembershipStates/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
    },
    "storageKey": {
      "href": "https://vssps.dev.azure.com/Fabrikam/_apis/Graph/StorageKeys/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
    },
    "avatar": {
      "href": "https://dev.azure.com/Fabrikam/_apis/GraphProfile/MemberAvatars/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
    }
  },
  "url": "https://vssps.dev.azure.com/Fabrikam/_apis/Graph/ServicePrincipals/aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3",
  "descriptor": "aadsp.ZTM1NTU0YzUtMjg2MC03MWFkLWIzYjAtNzkzNWViMDg1Njg3"
}

Definitions

Name	Description
GraphServicePrincipal
GraphServicePrincipalCreationContext	Do not attempt to use this type to create a new service principal. Use one of the subclasses instead. This type does not contain sufficient fields to create a new service principal.
ReferenceLinks	The class to represent a collection of REST reference links.

GraphServicePrincipal

Name	Type	Description
_links	ReferenceLinks	This field contains zero or more interesting links about the graph subject. These links may be invoked to obtain additional relationships or more detailed information about this graph subject.
applicationId	string
descriptor	string	The descriptor is the primary way to reference the graph subject while the system is running. This field will uniquely identify the same graph subject across both Accounts and Organizations.
directoryAlias	string	The short, generally unique name for the user in the backing directory. For AAD users, this corresponds to the mail nickname, which is often but not necessarily similar to the part of the user's mail address before the @ sign. For GitHub users, this corresponds to the GitHub user handle.
displayName	string	This is the non-unique display name of the graph subject. To change this field, you must alter its value in the source provider.
domain	string	This represents the name of the container of origin for a graph member. (For MSA this is "Windows Live ID", for AD the name of the domain, for AAD the tenantID of the directory, for VSTS groups the ScopeId, etc)
isDeletedInOrigin	boolean	When true, the group has been deleted in the identity provider
legacyDescriptor	string	[Internal Use Only] The legacy descriptor is here in case you need to access old version IMS using identity descriptor.
mailAddress	string	The email address of record for a given graph member. This may be different than the principal name.
metaType	string	The meta type of the user in the origin, such as "member", "guest", etc. See UserMetaType for the set of possible values.
origin	string	The type of source provider for the origin identifier (ex:AD, AAD, MSA)
originId	string	The unique identifier from the system of origin. Typically a sid, object id or Guid. Linking and unlinking operations can cause this value to change for a user because the user is not backed by a different provider and has a different unique id in the new provider.
principalName	string	This is the PrincipalName of this graph member from the source provider. The source provider may change this field over time and it is not guaranteed to be immutable for the life of the graph member by VSTS.
subjectKind	string	This field identifies the type of the graph subject (ex: Group, Scope, User).
url	string	This url is the full route to the source resource of this graph subject.

GraphServicePrincipalCreationContext

Do not attempt to use this type to create a new service principal. Use one of the subclasses instead. This type does not contain sufficient fields to create a new service principal.

Name	Type	Description
storageKey	string	Optional: If provided, we will use this identifier for the storage key of the created service principal

ReferenceLinks

The class to represent a collection of REST reference links.

Name	Type	Description
links	object	The readonly view of the links. Because Reference links are readonly, we only want to expose them as read only.

Share via