> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/azure-identities/entra-id/service-principals.md).

# Service Principals

The `Service Principals` page provides a list of enumerated service principals in entire Azure. The list contains the `Enabled`, `App Display Name`, `Service Principal Type`, `Privileged`, `Tier 0`, `Risk Score`, `Exposure Point` and `Issue Counts`.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-2a152c446ce6c576a11948b330644b683c5e364b%2Fservice-principal-1.png?alt=media" alt=""><figcaption><p>Service Principal</p></figcaption></figure>

## Service Principals Details

Details page contains the `Risk Score` of the group policy object, `Expsore Point`, `Information`, and `Issues` panes.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side of the `Information Pane`.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-839816525fc09e9a42f1b0919f2e9c7262ea19a1%2Fazure-identities-service-principals-image-1.png?alt=media" alt=""><figcaption><p>Service Principals Details</p></figcaption></figure>

## Information

`Information Pane` contains `Details`, `Groups`, `Roles` and `API Permissions` tabs respectively.

## Details

Details tab contains attributes below about service principals.

| Attribute                     | Description                                                                                                                                     |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**                      | The unique identifier for the service principal, often matching the application name and domain.                                                |
| **Enabled**                   | Indicates whether the service principal is currently active and permitted to authenticate or access resources.                                  |
| **Display Name**              | The user-friendly name of the service principal, shown in the Azure portal and logs.                                                            |
| **Login URL**                 | The sign-in URL associated with the application, if configured. This is blank if not provided during registration.                              |
| **App Display Name**          | The name of the Azure AD application that this service principal is linked to.                                                                  |
| **App Owner Organization ID** | The tenant ID of the organization that originally registered the application.                                                                   |
| **Description**               | An optional text field describing the purpose or use case of the service principal; blank if not filled in.                                     |
| **Tenant ID**                 | The unique identifier (GUID) of the Azure AD tenant where the service principal is registered.                                                  |
| **App Description**           | A field meant for describing the application associated with the service principal; this is blank if not provided.                              |
| **Object ID**                 | A globally unique identifier (GUID) assigned to the service principal within Azure AD, used for referencing and permissions.                    |
| **Service Principal Type**    | Indicates the origin or category of the service principal. In this case, `Application` means it was created for a registered app in the tenant. |

## Groups

Groups tab contains a list of groups that the service principal is a member of. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the privilege levels of these groups.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-332deeac0fac06308a6712f70d44328dffd17146%2Fazure-identities-service-principals-image-2.png?alt=media" alt=""><figcaption><p>Groups</p></figcaption></figure>

## Roles

Roles tab contains a list of roles that are directly related with the service principals.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-5242aebeadc2aef3f8a0ef4f3499dae28f3c5576%2Fazure-identities-service-principals-image-3.png?alt=media" alt=""><figcaption><p>Roles</p></figcaption></figure>

## ARM Roles

ARM Roles tab contains a list of the Azure Resource Manager role assignments held by the service principal. Directory roles and Graph permissions are only half of what an application can reach; the roles listed here are what it can do to Azure resources, so both need reviewing together.

## API Permissions

API Permissions tab contains a list of API permissions that are using by the service principals. The list also contains `Permission` and `Dangerous` columns.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-348f8d92917879ca8cc2f9e1a38cfe92d5947aa6%2Fazure-identities-service-principals-image-4.png?alt=media" alt=""><figcaption><p>API Permissions</p></figcaption></figure>

## Issues

Issues pane contains identified issues on the service principal object.

![Issues](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-df3f227910b03134f5ba81bafeabc9f9a847c0eb%2Fservice-principals-issues.png?alt=media)