title: How to get thumbprint of the cert associated with a service principal in AzureAD when the sp is created independently without App and Cred
body: <p>I have a service principal that I've creating using below powershell.</p>
  
  <pre><code>$sp3 = New-AzureRmADServicePrincipal `
      -DisplayName "&lt;service-principal-name&gt;" `
      -CertValue $certValue3 `
      -EndDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert3.Certificate.GetExpirationDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time'))
  
  </code></pre>
  
  <p>where <code>certValue3</code> is Base64String RawCertData. This service principal works fine and I am able to get a token when using the cert.</p>
  
  <p>Once service principal is created in Azure AD, how do I see thumbprint of the certificate associated with the service principal using Powershell?</p>
  
  <p>I've tried <a href="https://stackoverflow.com/a/58410371/3553799">this</a>, but I get <code>Forbidden</code> when I try to execute Get-AzureADApplicationKeyCredential</p>
  
  <p>I also checked the manifest in Azure Portal under the service principal that gets created under Azure Active Directory → App Registrations → &lt;service-principal-name&gt; → Manifest, but the <code>keyCredentials</code> node is empty</p>
  
  <pre><code>"keyCredentials": [],
  </code></pre>
  
  <p>Please note that when I create an application using <code>New-AzureRmADApplication</code> followed by credential <code>New-AzureRmADAppCredential</code> and then <code>New-AzureRmADServicePrincipal</code>, then I see the <code>keyCredentials</code> with <code>customKeyIdentifier</code> set to the certificate thumbprint. Sample script below - </p>
  
  <pre><code>$adapp = New-AzureRmADApplication -DisplayName "&lt;application-name&gt;" `
      -HomePage "&lt;home-page-url&gt;" `
      -IdentifierUris "&lt;identifier-url&gt;" `
      -CertValue $certValue `
      -StartDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert.Certificate.GetEffectiveDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time')) `
      -EndDate ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($cert.Certificate.GetExpirationDateString(), [System.TimeZoneInfo]::Local.Id, 'GMT Standard Time'))
  
  New-AzureRmADAppCredential -ApplicationId $adapp.ApplicationId -CertValue $certValue2 
  
  $sp2 = New-AzureRmADServicePrincipal -ApplicationId $adapp.ApplicationId -DisplayName "&lt;application-name&gt;"
  </code></pre>
  
  <p>How to get thumbprint of the certificate associated with a service principal in Azure AD using powershell when the service principal is created independently without AzureRmADApplication and AzureRmADAppCredential?</p>