azure.azcollection.azure_service_principal_attribute lookup – Look up Azure service principal attributes.

Note

This lookup plugin is part of the azure.azcollection collection (version 3.18.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install azure.azcollection. You need further requirements to be able to use this lookup plugin, see Requirements for details.

To use it in a playbook, specify: azure.azcollection.azure_service_principal_attribute.

New in azure.azcollection 1.12.0

Synopsis
Requirements
Keyword parameters
Notes
See Also
Examples
Return Value

Synopsis

Describes object id of your Azure service principal account.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

All python packages listed in collection’s requirements.txt must be installed via pip on the host that executes modules from azure.azcollection
Full installation instructions may be found https://galaxy.ansible.com/azure/azcollection
The host that executes this module must have the azure.azcollection collection installed via galaxy
msgraph-sdk
python >= 2.7

Keyword parameters

This describes keyword parameters of the lookup. These are the values key1=value1, key2=value2 and so on in the following examples: lookup('azure.azcollection.azure_service_principal_attribute', key1=value1, key2=value2, ...) and query('azure.azcollection.azure_service_principal_attribute', key1=value1, key2=value2, ...)

Parameter	Comments
auth_source string	Controls the source of the credentials to use for authentication. Can also be set via the `ANSIBLE_AZURE_AUTH_SOURCE` environment variable. When set to `auto` (the default) the precedence is module parameters -> `env` -> `credential_file` -> `cli`. When set to `env`, the credentials will be read from the environment variables When set to `cli`, the credentials will be sources from the Azure CLI profile. `subscription_id` or the environment variable `AZURE_SUBSCRIPTION_ID` can be used to identify the subscription ID if more than one is present otherwise the default az cli subscription is used. When set to `msi`, the host machine must be an azure resource with an enabled MSI extension. `subscription_id` or the environment variable `AZURE_SUBSCRIPTION_ID` can be used to identify the subscription ID if the resource is granted access to more than one subscription, otherwise the first subscription is chosen. The `msi` was added in Ansible 2.6. Choices: `"auto"` ← (default) `"cli"` `"env"` `"msi"` Configuration: Environment variable: `ANSIBLE_AZURE_AUTH_SOURCE`
client_id aliases: azure_client_id string	Azure client ID. Use when authenticating with a Service Principal or Managed Identity (msi). Can also be set via the `AZURE_CLIENT_ID` environment variable. Configuration: Environment variable: `AZURE_CLIENT_ID`
cloud_environment aliases: azure_cloud_environment string added in azure.azcollection 0.0.1	For cloud environments other than the US public cloud, the environment name (as defined by Azure Python SDK, eg, `AzureChinaCloud`, `AzureUSGovernment`), or a resource manager URL (required for Azure Stack). Can also be set via credential file profile or the `AZURE_CLOUD_ENVIRONMENT` environment variable. If setting to a URL, you must also set the ARM_CLOUD_METADATA_URL if the cloud is not registered with azcli. Default: `"AzureCloud"` Configuration: Environment variable: `AZURE_CLOUD_ENVIRONMENT`
oidc_token string	Direct OpenID Connect (OIDC) token (JWT) used for workload identity authentication. Configuration: Environment variable: `AZURE_FEDERATED_TOKEN`
oidc_token_file_path path	Path to a file containing an OpenID Connect (OIDC) token (JWT) used for workload identity authentication. Configuration: Environment variable: `AZURE_FEDERATED_TOKEN_FILE`
secret aliases: azure_secret string	Azure client secret. Use when authenticating with a Service Principal. Configuration: Environment variable: `AZURE_SECRET`
subscription_id string	Your Azure subscription Id. Configuration: Environment variable: `AZURE_SUBSCRIPTION_ID`
tenant aliases: azure_tenant string	Azure tenant ID. Use when authenticating with a Service Principal. Configuration: Environment variable: `AZURE_TENANT`

Notes

Note

If MSI is not enabled on ansible host, it’s required to provide a valid service principal which has access to the key vault.
To authenticate via service principal, pass client_id, secret and tenant or set environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET and AZURE_TENANT_ID.
Authentication via az login is also supported.
For authentication with Azure you can pass parameters, set environment variables, use a profile stored in ~/.azure/credentials, or log in before you run your tasks or playbook with az login.
Authentication is also possible using a service principal.
To authenticate via OIDC, pass client_id, tenant and oidc_token or oidc_token_file_path, or set environment variables AZURE_CLIENT_ID, AZURE_TENANT and AZURE_FEDERATED_TOKEN or AZURE_FEDERATED_TOKEN_FILE.
To authenticate via service principal, pass subscription_id, client_id, secret and tenant or set environment variables AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID, AZURE_SECRET and AZURE_TENANT.
Alternatively, credentials can be stored in ~/.azure/credentials. This is an ini file containing a [default] section and the following keys: subscription_id, client_id, secret and tenant.

Examples

set_fact:
  object_id: "{{ lookup('azure_service_principal_attribute',
                         client_id=azure_client_id,
                         secret=azure_secret,
                         tenant=azure_secret) }}"

Return Value

Key	Description
Return value string	Returns object id of service principal. Returned: success

Authors

Yunge Zhu (@yungezz)

Collection links

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/projects/ansible/latest/collections/azure/azcollection/azure_service_principal_attribute_lookup.html