In the previous lesson, we learned that Azure RBAC can assign roles to users, groups, service principals, and managed identities.
Users and groups mainly represent real people. But what happens when an application or an automated service (such as a CI/CD pipeline) needs to access Azure resources?
What is a Service Principal?
A Service Principal is an identity used by an application.
An “application” in this context can mean a small piece of code, or an automated process such as a CI/CD pipeline.
Applications need identities because they often interact with Azure resources, and they need to be authorized to do so. For example, an application might need to:
- Read files from an Azure Storage Account
- Retrieve a secret stored in Azure Key Vault
- Deploy Azure resources through an Azure DevOps Pipeline
Azure needs to determine whether that application is allowed to perform the request action.
Therefore, the application needs to:
- Have an identity
- Have roles assigned to that identity to be allowed to perform the required actions
A Service Principal provides the identity that the application needs.
Roles can then be assigned to the Service Principal to authorize it.
What is an App Registration?
To create an identity for an application, you normally begin by registering the application in Microsoft Entra ID.
This process is called an App Registration.
The App Registration contains the definition or configuration of the application.
It includes information such as:
- The application’s name
- The application ID
- The supported account types
- Redirect URIs
- Certificates and secrets
- API Permissions
After you register an application in Entra, two objects will be created for you:
- An application object
- A service principal object
The application object is a blueprint of the application.
The service principal is the application’s identity inside an Entra tenant.
If you decide to use your application’s identity in multiple tenants, you will have only one application object, but one service principal per tenant in which its used.
App Registrations vs Enterprise Applications
In Microsoft Entra ID, you will see two pages, which can be confusing because the application might appear in both places:
- App Registrations
- Enterprise Applications
The app registrations page contains application objects registered in your tenant.
The enterprise applications page contains service principals that exist in your tenant.
When you register an application inside your own tenant, you will see the application object in the app registrations screen, and the service principal in the enterprise applications screen.
How do Service Principals authenticate?
Just like a user has an email and a password, a service principal needs to have a way to authenticate to prove who he is.
Service Principals can choose between three types of credentials:
- Client secrets
- Certificates
- Federated credentials
A client secret is a string used by the application to prove its identity. You can think of it like a secret password that only the application knows.
When using certificate authentication, you create a public and a private key. The private key is only known by the application, and the public key is attached to the App Registration. To prove its identity, the application sends a message that could have only been signed with the private key.
What to remember for your exam
- A service principal is an identity used by an application, script, or automated process.
- Real people are identified through user identities, while software is identified through service principals.
- A service principal represents the application inside a tenant.
- The app registrations page contains the application objects registered in your tenant.
- The enterprise applications page contains service principals that exist in your tenant.
- A service principal can authenticate via client secrets, certificates, and federated credentials.
What’s next
Now that you have a solid foundation of service principals, in the next lesson you will learn how Azure provides built-in identities for Azure resources through Managed Identities.
