I'm having trouble determining a clear answer on tagging Service Principals as the documentation seems to say you can't do it (https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-support) while several github and other resources have a command for it like so:
az ad sp update --id <service_principal_id> --add tags "<tag_key>=<tag_value>"
To confirm, I created a Service Principal in my private portal instance for test purposes. I played with it a bit and believe this code should be correct:
$sp = Get-AzADServicePrincipal -DisplayName "tempdelete"
$tags = @{"name"="value"}
Set-AzResource -ResourceId $sp.Id -Tag $tags
When I do this, I get the following error:
az account set --subscription <mysubid>
Set-AzResource: MissingSubscription : The request did not have a subscription or a valid tenant level resource provider.
CorrelationId: <some correlation id that changes every time>
The app is part of that subscription (it's my only subscription) and I'm not sure what I need to change to make this work.
There are no particular tags for service principal. Tags will only support azure resources.
Alternatively, you can assign the tag name and tag values using notes. For reference check below-
az ad sp update --id '12345-11bc-123-456-57d4362d6ee9' --set notes="Tag: Env=dev"
az ad sp show --id '123457-17bc-4f0a-b432-abcdefgh'
You can also filter the application based on the tag value and tag name
az ad sp list --query "[?notes!=null && contains(notes, 'Tag: Env=dev')]" --all --output json