New-AzFederatedIdentityCredential

  • Reference
Module:
Az.ManagedServiceIdentity

Create or update a federated identity credential under the specified user assigned identity.

Syntax

New-AzFederatedIdentityCredential
   -IdentityName <String>
   -Name <String>
   -ResourceGroupName <String>
   [-SubscriptionId <String>]
   [-Audience <String[]>]
   [-Issuer <String>]
   [-Subject <String>]
   [-DefaultProfile <PSObject>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

Create or update a federated identity credential under the specified user assigned identity.

Examples

Example 1: Create a federated identity credential under the specified user assigned identity

New-AzFederatedIdentityCredential -ResourceGroupName azure-rg-test -IdentityName uai-pwsh01 `
    -Name fic-pwsh01 -Issuer "https://kubernetes-oauth.azure.com" -Subject "system:serviceaccount:ns:svcaccount"

Name       Issuer                             Subject                             Audience
----       ------                             -------                             --------
fic-pwsh01 https://kubernetes-oauth.azure.com system:serviceaccount:ns:svcaccount {api://AzureADTokenExchange}

This command creates a federated identity credential under the specified user assigned identity.

Example 2: Create a federated identity credential under the specified user assigned identity with 'Audience' override

New-AzFederatedIdentityCredential -ResourceGroupName azure-rg-test -IdentityName uai-pwsh01 `
    -Name fic-pwsh01 -Issuer "https://kubernetes-oauth.azure.com" -Subject "system:serviceaccount:ns:svcaccount" `
    -Audience @("api://AzureADTokenExchange-Modified")

Name       Issuer                             Subject                             Audience
----       ------                             -------                             --------
fic-pwsh01 https://kubernetes-oauth.azure.com system:serviceaccount:ns:svcaccount {api://AzureADTokenExchange}

This command creates a federated identity credential under the specified user assigned identity with the custom audience

Parameters

-Audience

The list of audiences that can appear in the issued token.

Type:String[]
Position:Named
Default value:@("api://AzureADTokenExchange")
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Type:PSObject
Aliases:AzureRMContext, AzureCredential
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-IdentityName

The name of the identity resource.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Issuer

The URL of the issuer to be trusted.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Name

The name of the federated identity credential resource.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Subject

The identifier of the external identity.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-SubscriptionId

The Id of the Subscription to which the identity belongs.

Type:String
Position:Named
Default value:(Get-AzContext).Subscription.Id
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

Outputs

IFederatedIdentityCredential

Notes

ALIASES

New-AzFederatedIdentityCredentials