title: Access service principal for Microsoft.Azure.WebSites Resource Provider (Microsoft Azure App Service) from Azure pipeline task
body: <p>I want to create a key vault that will store a TLS certificate. This key vault needs to be accessible from Azure pipeline tasks, which will retrieve the said certificate and bind it to their apps. <a href="https://github.com/Azure/azure-quickstart-templates/blob/master/201-web-app-certificate-from-key-vault/README.md" rel="nofollow noreferrer">Microsoft mentions</a>:</p>
  <blockquote>
  <p>By default, 'Microsoft.Azure.WebSites' Resource Provider (RP) doesn't have access to the Key Vault specified in the template hence you need to authorize it by executing the following PowerShell commands before deploying the template:</p>
  <pre><code>Login-AzureRmAccount
  Set-AzureRmContext -SubscriptionId AZURE_SUBSCRIPTION_ID
  Set-AzureRmKeyVaultAccessPolicy -VaultName KEY_VAULT_NAME -ServicePrincipalName abfa0a7c-a6b6-4736-8310-5855508787cd -PermissionsToSecrets get
  </code></pre>
  </blockquote>
  <p>This works for my key vault when I do it manually. However, I want to automate this as part of my master pipeline. I've tried defining this task:</p>
  <pre><code>- task: AzurePowerShell@5
    displayName: 'Set key vault policy'
    inputs:
      azureSubscription: …
      azurePowerShellVersion: 'LatestVersion'
      ScriptType: 'InlineScript'
      Inline: |
        Set-AzKeyVaultAccessPolicy -VaultName … -ServicePrincipalName abfa0a7c-a6b6-4736-8310-5855508787cd -PermissionsToSecrets get
  </code></pre>
  <p>But it fails:</p>
  <pre><code>##[error]Operation returned an invalid status code 'Forbidden'
  </code></pre>
  <p>I've also noticed that this service principal for &quot;Microsoft Azure App Service&quot; isn't even available to my task; the following prints a blank:</p>
  <pre><code> $azureAppServicePrincipal = Get-AzADServicePrincipal -ServicePrincipalName abfa0a7c-a6b6-4736-8310-5855508787cd
   Write-Output &quot;azureAppServicePrincipalId = $($azureAppServicePrincipal.Id)&quot;
  </code></pre>
  <p>Is there a way of making this service principal accessible to my pipeline?</p>