Blog Post

Azure Tools Blog
1 MIN READ

Azure Active Directory breaking change impacting Azure CLI and Azure PowerShell

dcaro's avatar
dcaro
Icon for Microsoft rankMicrosoft
Oct 15, 2021

Context

Starting 10/15/2021, Azure Active directory will require the AppId Uri in single tenant applications to use default scheme or verified domains. If you have not upgraded Azure CLI or Azure PowerShell to the most recent versions, you will receive the following error message when creating a service principal:

 

Values of identifierUris property must use a verified domain of the organization or its subdomain

 

Solution

You must upgrade to the following versions for reach impacted:

  • Azure CLI version 2.25.0 or later
  • Azure PowerShell version 6.0.0 or later

 

You can read more about the impact of this breaking change in each tool:

 

Workaround

We understand that upgrading to a new version of an automation tool is not always straightforward, the workaround consists of the following steps:

  1. If needed, add your custom domain name using Azure Active Directory portal
  2. Create the application with an authorized IdentifierUri
  3. Create the service principal referring to this application

 

 

Published Oct 15, 2021
Version 1.0
azurecli
powershell
  • carlintveld's avatar
    carlintveld
    Brass Contributor
    Oct 29, 2021

    We use many Azure services. For me personally it works best if the Az PowerShell cmdlets start throwing warnings when there are upcoming breaking changes or the Azure Portal starts reporting it. I don't track any website in particular.

  • carlintveld's avatar
    carlintveld
    Brass Contributor
    Oct 25, 2021

    Was there any upfront communication about this new naming policy for app registration ids? We complete missed out!

  • saurabhmadan's avatar
    saurabhmadan
    Icon for Microsoft rankMicrosoft
    Oct 29, 2021

    Hi carlintveld , Yes the change information was published in the breaking changes section of Azure AD docs. Sorry, this didn't catch your attention in time.
    If there's another Azure AD notification mechanism that you currently subscribe, please let us know. I'll make sure to update our playbook so other team members can learn from it.

  • dixue's avatar
    dixue
    Icon for Microsoft rankMicrosoft
    Nov 10, 2021

    We have added breaking change warning on cmdlets. It is a little short, just one or two months. If user doesn't use the latest version of Az.Resources, they cannot see this message either. We will consider how to show those messages on Azure PowerShell online docs.