Using Azure AD Service Principals to Secure Applications

Custom applications typically need access to other resources in Azure, such as databases, REST APIs, and other PaaS services.  Azure AD allows you to create applications that function as service principals which enable your application to authenticate with Azure AD and can be granted roles within your subscription to provide access to resources in a secure way.

In the past, using the classic Azure Service Management API, Azure required you to create a self-signed management certificate and upload it to the portal to be used to authenticate an administrator.  This model has been replaced with the new ARM model.  Now you must authenticate as your service principal to Azure AD.  Your service principal must then be granted the necessary RBAC role in your subscription to gain access to resources.

Service principals can be authenticated by Azure AD either by:

1.  A Client ID and Secret.  The "Configure" tab in the Azure AD "Application" entry will display the applications Client ID as well as the option to create keys that function as the application secret.

2.  A certificate. Using PowerShell, you can upload and bind a certificate to an Azure AD principal that can be used for authentication. Once you have created your service principal, you can then use the ADAL library from just about any language or platform to authenticate using your credentials or your certificate to get back a JWT token which you can then use to authorize your application to just about any Azure resource