necessary roles for updating client secret at Azure Enterprise Application

Hello @nobuko nagahara

Necessary Permissions

To update a client secret in Azure, the user making the request typically needs the following permissions:

• Application Administrator
• Cloud Application Administrator
• Global Administrator
• Owner of the Service Principal

These roles allow the user to manage application settings, including updating client secrets.

Updating Client Secrets

Once the user has the necessary permissions, here's how to update the client secret:

1. Sign in to the Azure portal.
2. Navigate to Microsoft Entra ID > Manage > App registrations.
3. Select the application for which you want to update the client secret.
4. On the application’s page, look for the Certificates & secrets section.
5. Under Client secrets, you can create a new secret by selecting New client secret or you can modify an existing one if applicable.

Restricting Client Secret Updates

To restrict who can update client secrets, you might consider using App Roles which allow you to define permissions around who can manage specific functionalities of your application. Specifically:

1. Define custom app roles in your Azure AD application.
2. Assign those roles selectively to users or groups, ensuring that only authorized individuals can update the client secret.