Service Principal

What is a service principal?

A service principal is a non-human identity that represents an application or a service inside a Microsoft Entra ID tenant, and the object to which its permissions, role assignments and credentials are attached. The app registration defines the application once; the service principal is its local instance in each tenant that uses it.

Key takeaways

• A service principal is the local identity of an application in a Microsoft Entra ID tenant, where its permissions and role assignments are granted.
• An app registration defines an application once in its home tenant, while every tenant that uses the application gets its own service principal.
• A service principal signs in with a client secret, a certificate or a federated credential, and a managed identity leaves credential handling to the platform.
• Microsoft Graph application permissions granted to a service principal through admin consent stay active until someone reviews and removes them.

How a service principal works

• Registration: registering an application creates the application object, with its name, redirect URIs, requested permissions and credentials.
• Instantiation: Entra ID creates a service principal in every tenant that uses the application, at registration in the home tenant and on consent elsewhere.
• Types: application service principals come from an app registration, managed identities are tied to an Azure resource, and legacy ones predate app registrations.
• Credentials: client secrets, certificates or federated credentials, which trust tokens from an external system such as a CI/CD pipeline and store no secret.
• Permissions: delegated permissions act for a signed-in user, while application permissions let the service principal act alone across the tenant and need admin consent.

Service principal, app registration or service account: what is the difference?

• App registration: the global definition of the application (the application object), kept in its home tenant, one per application.
• Service principal: its instance in a given tenant, listed under enterprise applications in the Entra admin center, where consent, permissions and role assignments live.
• Service account: a user-type account run by a program, usually with a password. Nothing ties it to an application definition, so its purpose and owner are easily lost.

The risks come from the lifecycle. A service principal created by someone who has left has no owner. A long-lived client secret is forgotten. A broad Microsoft Graph application permission, such as reading every mailbox, granted once by an admin for a pilot, outlives the pilot. Kerberos also uses the word: a service principal name (SPN) identifies a service instance for ticket requests, a separate concept.

Examples and use cases

Take a 300-person company that has run Microsoft Entra ID for years. A security review lists 140 enterprise applications in the tenant: around 30 in active use, a dozen created by former employees with no owner, and two holding the Mail.Read application permission from a migration project. One still has a valid client secret that nobody can trace.

The cleanup happens in Entra ID: assign owners, replace client secrets with certificates or managed identities, and remove unused permissions. Corma covers the SaaS side: it connects natively to Microsoft Entra ID, keeps a complete inventory of the SaaS applications in use with their licenses and contracts, and runs access reviews with audit evidence, giving the team a reference list to compare with the tenant.

Related concepts

• Service account
• Workload identity
• Microsoft Entra ID (formerly Azure AD)
• Non-human identity (NHI)
• Secrets management
• Corma identity and access management platform

FAQ

What is the difference between a service principal and an app registration?

An app registration is the global definition of an application, created once in its home tenant. A service principal is its instance in a specific tenant, where permissions and role assignments are granted.

Is a service principal the same as a service account?

No. A service account is a user-type account used by a program, usually with a password. A service principal is an application identity in Entra ID with its own credentials, and it cannot sign in interactively.

Can a service principal use MFA?

No. A service principal authenticates with a secret, a certificate or a federated credential, never a second factor, so narrow permissions and protected credentials matter most.

How do you secure a service principal?

Give each service principal an owner, grant only the permissions it needs, prefer certificates or managed identities to client secrets, and review its permissions regularly.

Request a demo