How to rotate the password of service principle through API's??

Question

How to rotate the password of service principle through API's??

Likith Kacham 0

We would be doing a scim integration between CyberArk and Azure, To automate this procedure we would like to rotate the password of service principle through API's.

Could you please guide me and share us some API's which can rotate the password of Service principle.

Regards,

Likith

Anurag Rohikar 3,190 Reputation points Microsoft External Staff Moderator

2025-09-18T10:10:17.4033333+00:00
Hello Likith Kacham,

Thanks for reaching out, Likith! To help us guide you to the right API and steps, could you clarify a few things:

Are you rotating client secrets (password credentials) or certificates for the service principal?

Are you working with the App Registration object itself or the Enterprise Application (service principal) in your tenant?

Which platform or tool will actually call Microsoft Graph - CyberArk directly, Azure Automation, or something else?

Do you already have the necessary Microsoft Graph permissions (e.g., Application.ReadWrite.All) consented in your environment?

Is this rotation part of an existing SCIM integration workflow, or are you building a new process?

Once we have this context, we can point you to the exact API calls and sequence to use. Thank you!
Anurag Rohikar 3,190 Reputation points Microsoft External Staff Moderator

2025-09-19T08:01:29.5166667+00:00

Hello Likith Kacham, following up to see if you have a chance to check my previous response and help us with requested information to check and assist you further on this. Thank you!
Likith Kacham 0 Reputation points

2025-09-19T08:06:49.3833333+00:00

Hi Anurag,

If possible can we have quick call?

I can show you something which we have configured, Please share the invite to ******@gsk.com if you are ok.

Regards,

Likith
Carolyne Milgo 1,151 Reputation points

2025-11-24T07:18:27.5866667+00:00

To rotate a service principal password (client secret) using Microsoft Graph API, you’ll use the addPassword and optionally removePassword endpoints.
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/addPassword
https://graph.microsoft.com/v1.0/servicePrincipals(appId='{appId}')/addPassword
Permissions required are outlined in the doc but at minimum for Application Permissions: Application.ReadWrite.All or Application.ReadWrite.OwnedBy
Using Powershell- https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/add-mgserviceprincipalpassword?view=graph-powershell-1.0
In Powershell-
$``params = @{

    ``passwordCredential = @{

        ``displayName = "RotatedSecret"

    ``}

}

Add``-MgServicePrincipalPassword -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Your answer

Anurag Rohikar 3,190 Reputation points Microsoft External Staff Moderator

2025-09-18T10:10:17.4033333+00:00

Hello Likith Kacham,

Thanks for reaching out, Likith! To help us guide you to the right API and steps, could you clarify a few things:

Are you rotating client secrets (password credentials) or certificates for the service principal?

Are you working with the App Registration object itself or the Enterprise Application (service principal) in your tenant?

Which platform or tool will actually call Microsoft Graph - CyberArk directly, Azure Automation, or something else?

Do you already have the necessary Microsoft Graph permissions (e.g., Application.ReadWrite.All) consented in your environment?

Is this rotation part of an existing SCIM integration workflow, or are you building a new process?

Once we have this context, we can point you to the exact API calls and sequence to use. Thank you!
Anurag Rohikar 3,190 Reputation points Microsoft External Staff Moderator

2025-09-19T08:01:29.5166667+00:00

Hello Likith Kacham, following up to see if you have a chance to check my previous response and help us with requested information to check and assist you further on this. Thank you!
Likith Kacham 0 Reputation points

2025-09-19T08:06:49.3833333+00:00

Hi Anurag,

If possible can we have quick call?

I can show you something which we have configured, Please share the invite to ******@gsk.com if you are ok.

Regards,

Likith
Carolyne Milgo 1,151 Reputation points

2025-11-24T07:18:27.5866667+00:00

To rotate a service principal password (client secret) using Microsoft Graph API, you’ll use the addPassword and optionally removePassword endpoints.
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/addPassword
https://graph.microsoft.com/v1.0/servicePrincipals(appId='{appId}')/addPassword
Permissions required are outlined in the doc but at minimum for Application Permissions: Application.ReadWrite.All or Application.ReadWrite.OwnedBy
Using Powershell- https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/add-mgserviceprincipalpassword?view=graph-powershell-1.0
In Powershell-
$``params = @{

``passwordCredential = @{

``displayName = "RotatedSecret"

``}

}

Add``-MgServicePrincipalPassword -ServicePrincipalId $servicePrincipalId -BodyParameter $params