Service Principals
Open Unified Identities › Non Human Identities, filter Providers to Entra ID › Service Principal, then select a row to open its details.
Service Principals Details
Opening a service principal shows the Risk and Exposure Point in the header, and the page contains the Information and Issues panes.
Information
Information Pane can contain different badges to highlight important attributes.
Shadow
Indicates that the object can compromise admin objects with at least one attack path.
Privileged
Indicates that the object is Privileged.
ARM Privileged
Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher.
Enabled
Indicates that the object is enabled.
Disabled
Indicates that the object is disabled.
Tier 0 / Tier 2
Indicates the tier of the object.
Information Pane contains Details, Groups, Roles, ARM Roles and API Permissions tabs respectively. Each tab except Details carries the number of rows it holds in its label.
Details
Details tab contains attributes below about service principals.
Name
The unique identifier for the service principal, often matching the application name and domain.
Enabled
Indicates whether the service principal is currently active and permitted to authenticate or access resources.
Display Name
The user-friendly name of the service principal, shown in the Azure portal and logs.
Login URL
The sign-in URL associated with the application, if configured. This is blank if not provided during registration.
App Display Name
The name of the Azure AD application that this service principal is linked to.
App Owner Organization ID
The tenant ID of the organization that originally registered the application.
Description
An optional text field describing the purpose or use case of the service principal; blank if not filled in.
Tenant
The Entra ID tenant where the service principal is registered, linking to its Tenant page.
App Description
A field meant for describing the application associated with the service principal; this is blank if not provided.
Service Principal Type
Indicates the origin or category of the service principal. In this case, Application means it was created for a registered app in the tenant.
Last Sign-In Time
The most recent sign-in of the service principal, shown as elapsed time and date.
Groups
Groups tab contains a list of groups that the service principal is a member of. This list also contains Enabled and On Prem Sync Enabled columns to identify the status of these groups.
Roles
Roles tab contains a list of the Entra ID roles assigned to the service principal, with Enabled, Built In and Assigned columns.
ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments held by the service principal. Directory roles and Graph permissions are only half of what an application can reach; the roles listed here are what it can do to Azure resources, so both need reviewing together.
API Permissions
API Permissions tab contains a list of API permissions granted to the service principal. The list also contains Permission and Dangerous columns.
Issues
Issues pane contains identified issues on the service principal object.
Last updated
Was this helpful?