Open Unified Identities › Non Human Identities, filter Providers to Entra ID › Service Principal, then select a row to open its details.
Service Principal
Service Principals Details
Opening a service principal shows the Risk and Exposure Point in the header, and the page contains the Information and Issues panes.
You can analyze the object in the Graph by clicking the Graph » button next to the Information title. For a shadow admin the button reads Admin Path » and opens the shortest path to admin objects (see Object Detail Pages).
Service Principal Details
Information
Information Pane can contain different badges to highlight important attributes.
| Badge | Description |
|---|---|
| Shadow | Indicates that the object can compromise admin objects with at least one attack path. |
| Privileged | Indicates that the object is Privileged. |
| ARM Privileged | Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher. |
| Enabled | Indicates that the object is enabled. |
| Disabled | Indicates that the object is disabled. |
| Tier 0 / Tier 2 | Indicates the tier of the object. |
Information Pane contains Details, Groups, Roles, ARM Roles and API Permissions tabs respectively. Each tab except Details carries the number of rows it holds in its label.
Details
Details tab contains attributes below about service principals.
| Attribute | Description |
|---|---|
| Name | The unique identifier for the service principal, often matching the application name and domain. |
| Enabled | Indicates whether the service principal is currently active and permitted to authenticate or access resources. |
| Display Name | The user-friendly name of the service principal, shown in the Azure portal and logs. |
| Login URL | The sign-in URL associated with the application, if configured. This is blank if not provided during registration. |
| App Display Name | The name of the Azure AD application that this service principal is linked to. |
| App Owner Organization ID | The tenant ID of the organization that originally registered the application. |
| Description | An optional text field describing the purpose or use case of the service principal; blank if not filled in. |
| Tenant | The Entra ID tenant where the service principal is registered, linking to its Tenant page. |
| App Description | A field meant for describing the application associated with the service principal; this is blank if not provided. |
| Service Principal Type | Indicates the origin or category of the service principal. In this case, Application means it was created for a registered app in the tenant. |
| Last Sign-In Time | The most recent sign-in of the service principal, shown as elapsed time and date. |
Groups
Groups tab contains a list of groups that the service principal is a member of. This list also contains Enabled and On Prem Sync Enabled columns to identify the status of these groups.
Groups
Roles
Roles tab contains a list of the Entra ID roles assigned to the service principal, with Enabled, Built In and Assigned columns.
Roles
ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments held by the service principal. Directory roles and Graph permissions are only half of what an application can reach; the roles listed here are what it can do to Azure resources, so both need reviewing together.
API Permissions
API Permissions tab contains a list of API permissions granted to the service principal. The list also contains Permission and Dangerous columns.
API Permissions
Issues
Issues pane contains identified issues on the service principal object.
Issues