Application Registration created with "az ad sp create-for-rbac" defaults to global sign-in-audience

[michaelhambe]

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Related command
az ad sp create-for-rbac n {name} --scope {scope} --role {role}

Describe the bug
In the past, this command would create both the service principal and application registration, where the application registration would be a single-tenant app. However, the behaviour seems to have changed as new app registrations are multi-tenant by default, with no option to choose.

To Reproduce
az ad sp create-for-rbac -n {name} --scope {scope} --role {role}

Expected behaviour
The resultant application registration is single-tenant, or a new flag is added to allow the user to choose.

The documentation could also be updated to indicate that the az ad sp command created both a Service Principal and an Application Registration.

Environment summary
Azure CLI 2.46.0 installed on OSX via Homebrew

Additional context

[yonzhan]

@jiasli for awareness

[jiasli]

It looks like a behavior change between AD Graph and MS Graph's Create application API.

AzureADandPersonalMicrosoftAccount is now the default value of signInAudience in MS Graph.

There are 2 workarounds:

1. Run az ad app create with --sign-in-audience to manually create the app and az ad sp create to create its corresponding service principal
2. After running az ad sp create-for-rbac, run az ad app update with --sign-in-audience to modify the app

[michaelhambe]

Shouldn't the default signInAuduence be the least permissive?

[michaelhambe]

Hi @jiasli

Having application registrations default to multi-tenant seems to contradict this documentation:

https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#update-registration-to-be-multi-tenant

which states that "By default, web app/API registrations in Azure AD are single-tenant upon creation."

[davejhahn]

This is also happening with az ad app create - assuming this is the same problem.