Account Profile for Service Principal

Important
If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access, Azure Cloud Object Management , such as, Management Groups, Subscriptions, Resource Groups and Role Assignment, you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

The following lists the create service principal profile attributes:

Note

Attributes with app in the name are Application object properties and all others are Service Principal object properties.

For example,

  • spn_app_owners is for directory objects that are owners of the application.

  • spn_owners is for directory objects that are owners of this service principal.

Attribute Name

Description

spn_appDisplayName

The display name for the application.

spn_homepage

This is the home page or landing page of the application.

spn_loginUrl

Displays the URL where the service provider redirects the user to Microsoft Entra ID to authenticate.

spn_logoutUrl

Displays the URL that will be used by Microsoft's authorization service to log out a user.

description

The description that is displayed in the address book for the user or service principal.

spn_appRoles

The roles exposed by the application that this service principal represents.

spn_app_keyCredentials

The collection of password credentials associated with the application.

spn_tags

The custom strings that can be used to categorize and identify the service principal.

spn_passwordCredentials

The collection of password credentials associated with the application.

spn_app_owners

Directory objects that are owners of the application.

spn_owners

Directory objects that are owners of this servicePrincipal.

spn_app_passwordCredentials

The collection of password credentials associated with the application.

spn_appTemplateName

The name of the template that is used to create the application and service principal.

spn_appTemplateId

The ID of the template that is used to create the application and service principal.

spn_appId

The app ID of the multi-tenant application for which the service principal needs to be created.

Note

  • When a create Service Principal request is executed, the connector creates the application object first and then the corresponding service principal object is created.

  • To create the applications from gallery templates, either spn_appTemplateName or spn_appTemplateId needs to be provided in the create request along with spn_appDisplayName. For more information, refer to sample request example 3 and example 4.

  • To create the service principal for a multi-tenant application, spn_appId needs to provided in the create request, For more information, refer to sample request example 5.