Batch Service Principals Creator

PowerShell script to automate the creation of Microsoft Entra ID Application Registrations and Service Principals with delegated API permissions.

Prerequisites

• PowerShell 7.0+
• Microsoft Graph PowerShell SDK modules
• Microsoft Entra ID role: Application Administrator or Cloud Application Administrator (minimum)
  • Required to create app registrations and service principals
  • Privileged Role Administrator or Global Administrator - only required when using -GrantAdminConsent $true (default)

Module installation

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser
Install-Module Microsoft.Graph.DirectoryObjects -Scope CurrentUser

Parameters

-StartIndex (Default: 81)
Starting number for application names

-EndIndex (Default: 81)
Ending number for application names

-NamePrefix (Default: "cportingnfead365etl")
Prefix for application display names

-NameSuffix (Default: "a")
Suffix for application display names

-DesiredSecretDays (Default: 730)
Client secret validity period in days (1-730)

-OutputCsvPath (Default: ".\serviceprincipals.csv")
Path for the output CSV file

-ForceNewSecret (Default: $true)
Generate new secrets for existing applications

-GrantAdminConsent (Default: $true)
Grant tenant-wide admin consent for delegated permissions. Set to $false to skip consent (users will consent individually)

-WhatIf
Simulate execution without making changes

Output

The script generates a CSV file with:

• Application ID (Client ID)
• Application Display Name
• Client Secret
• Secret Expiration Date
• Service Principal Object ID

Permissions Configured

The script configures delegated permissions for:

• Dynamics CRM: user_impersonation
• Microsoft Graph: User.Read

Admin Consent

By default (-GrantAdminConsent $true), the script grants tenant-wide admin consent for these permissions, allowing all users in your organization to use these applications without individual consent prompts.

If you set -GrantAdminConsent $false, the permissions are configured but not consented. Each user will be prompted to consent when they first use the application.

Required Graph API Scopes

• Application.ReadWrite.All
• Directory.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• DelegatedPermissionGrant.ReadWrite.All (only when using -GrantAdminConsent $true)

Usage & Examples

Basic execution with defaults:

.\new-batchserviceprincipals.ps1

Test without creating resources (WhatIf mode):

.\new-batchserviceprincipals.ps1 -WhatIf

Create multiple service principals:

.\new-batchserviceprincipals.ps1 -StartIndex 1 -EndIndex 10

Create 10 service principals without forcing new secrets:

.\new-batchserviceprincipals.ps1 -StartIndex 1 -EndIndex 10 -ForceNewSecret $false

Custom configuration with naming and 1-year secrets:

.\new-batchserviceprincipals.ps1 -StartIndex 50 -EndIndex 60 -NamePrefix "prod-app" -DesiredSecretDays 365

Create apps without granting tenant-wide admin consent:

.\new-batchserviceprincipals.ps1 -GrantAdminConsent $false

Full custom example:

.\new-batchserviceprincipals.ps1 -NamePrefix "myapp" -StartIndex 1 -EndIndex 5 -DesiredSecretDays 365 -OutputCsvPath ".\output.csv" -GrantAdminConsent $false