New-MsolServicePrincipal

Syntax

New-MsolServicePrincipal
   [-ServicePrincipalNames <String[]>]
   [-AppPrincipalId <Guid>]
   -DisplayName <String>
   [-AccountEnabled <Boolean>]
   [-Addresses <RedirectUri[]>]
   [-Type <ServicePrincipalCredentialType>]
   [-Value <String>]
   [-StartDate <DateTime>]
   [-EndDate <DateTime>]
   [-Usage <ServicePrincipalCredentialUsage>]
   [-TenantId <Guid>]
   [<CommonParameters>]

Description

The New-MsolServicePrincipal cmdlet creates a service principal that can be used to represent a Line Of Business (LOB) application or an on-premises server such as Microsoft Exchange, SharePoint or Lync in Microsoft Azure Active Directory as service principal objects. Adding a new application as a service principal allows that application to authenticate to other services such as Microsoft Office 365.

Examples

Example 1: Create a service principal

PS C:\> New-MsolServicePrincipal -ServicePrincipalNames @("MyApp/myApp.com") -DisplayName "My Application"

This command creates a service principal. In this example, the service principal is created with the service principal name MyApp/myApp.com, the display name My Application, and will use an auto-generated 256 bit symmetric key to verify the application. This key will be valid for a year from today.

Example 2: Create a service principal that uses an X509 certificate

PS C:\> $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate
PS C:\> $cer.Import("C:\temp\myapp.cer")
PS C:\> $binCert = $cer.GetRawCertData()
PS C:\> $credValue = [System.Convert]::ToBase64String($binCert);
PS C:\> New-MsolServicePrincipal -ServicePrincipalNames @("MyApp/myApp.com") -DisplayName "My Application" -Type asymmetric -Value $credValue

This example creates a service principal. In this example, the service principal is created with the service principal name MyApp/myApp.com, the display name My Application, and uses the supplied X509 certificate myapp.cer that is configured with a base 64 encoded asymmetric key.

Parameters

-AccountEnabled

-Addresses

-AppPrincipalId

-DisplayName

-EndDate

-ServicePrincipalNames

-StartDate

-TenantId

-Type

-Usage

-Value

Outputs

Microsoft.Online.Administration.ServicePrincipalExtended

This cmdlet returns the service principal that it added. This includes the following information:

• ObjectId. The unique identifier of the service principal.
• AppPrincipalId. The application identifier of the service principal.
• DisplayName. The friendly name of the service principal.
• ServicePrincipalName. The list of service principal names (SPNs) associated with the service principal.
• TrustedForDelegation. The value indicating if the service principal is allowed for delegation.
• AccountEnabled. The value indicating if the account is enabled.

It also retrieves the list of credentials that were added. Each credential object contains the following information:

• Type. The type of service principal credential (Asymmetric/Symmetric/Other).
• Value. The value of the credential. If the credential type is certificate, this represents the base 64 encoded certificate. If credential type is symmetric, it represents an AES key.
• KeyGroupId. The identifier reserved for internal use.
• KeyId. The unique identifier of the key.
• StartDate. The effective start date of the credential usage.
• EndDate. The effective end date of the credential usage.
• Usage. Specifies if the credential is used to sign or verify a token.

Related Links

• Get-MsolServicePrincipal
• New-MsolServicePrincipalAddresses
• Remove-MsolServicePrincipal
• Set-MsolServicePrincipal