We still need to finalize our choice on the command group naming for federatedIdentityCredential:

• federated-credential: Consistent with Azure Portal, but inconsistent with the underlying REST API federatedIdentityCredential
  
• federated-identity-credential: Consistent with the underlying REST API, but too long to type
• fic: Consistent with the underlying REST API, but the user will need to learn a new term

federated-credential is probably a good middle ground

Done. Renamed.

We need to decide whether show/update/delete command should take --credential-id or --key-id:

• --credential-id: Consistent with REST API federatedIdentityCredentialId
• --key-id: Consistent with other credentials’ (passwordCredentials, keyCredentials) keyId

For example, passwordCredentials returns keyId:

> az ad app credential list --id 233dd73b-72e3-424a-9367-7588d957267e
[
  {
    "customKeyIdentifier": null,
    "displayName": "rbac",
    "endDateTime": "2023-05-19T10:30:09Z",
    "hint": "m6_",
    "keyId": "5858baa7-1fe3-4659-9ee8-2d4a172b79a4",
    "secretText": null,
    "startDateTime": "2022-05-19T10:30:09Z"
  }
]

but federatedIdentityCredential only returns id:

> az ad app federated-credential list --id 233dd73b-72e3-424a-9367-7588d957267e
Command group 'ad app federated-credential' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
[
  {
    "audiences": [
      "api://AzureADTokenExchange"
    ],
    "description": "",
    "id": "a8d289e5-28eb-4f16-8243-cc8b43f2d9fe",
    "issuer": "https://token.actions.githubusercontent.com",
    "name": "github-fic",
    "subject": "repo:azure/azure-cli:pull_request"
  }
]

Can it support both?

Implementing both certainly causes unnecessary learning effort and complication.

We should decide whether create command should take JSON or flattened params:

• JSON (like --parameters @fic_manifest.json): Consistent with manifest and REST API, but is difficult to input in terminal. It may also trigger PowerShell issue ([Shell] Azure CLI receives corrupted arguments in PowerShell #15529). Luckily that issue can be bypassed using file input.
• Flattened params (like --audiences api://AzureADTokenExchange --issuer "https://token.actions.githubusercontent.com"): Easy to type in command line, but user has to run create command multiple times to create multiple credentials.

why is it difficult?

Typing a JSON by hand seems difficult to me. 😂

User would have a JSON file on disc and pass that to this param.

If that's the expected usage, I will implement that way.

We should be able to directly bind to the SDK and remove this custom function, but since we haven't decided whether to use flattened params or JSON (#22727 (comment)), we leave it here for future customization.

This command group is far from stable. We mark it as experimental.

This actually inspires me of a new naming convention.

Instead of using create_application for az ad app create (which is inconsistent):

the custom function can be named app_create to match the command name and the binding can be done in a uniform way.

Also, it becomes much easier to find the function in the function list: