Workload Identity Attributes
Service Principal As Accounts Attributes
You can automate the process of adding Service Principal account attributes to the account schema, with the toggle option for Manage Azure Service Principal As Account during Account Schema configuration. This reduces your efforts by automating the Service Principal account attributes addition process. It allows the segregation of various feature attributes within account schema for better retreival.
Important
Ensure Manage Microsoft Entra Service Principals as Accounts during Manage Microsoft Entra Service Principals as Accounts configuration is selected to aggregate Azure Service Principals along with users during the account aggregation process.
Select Include Attributes in Schema for managing azure Service Principal as account to automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration.
To manage Service Principals, following lists the attributes that are present in the account schema:
| Schema Attribute Name | Type | Description |
|---|---|---|
| objectId | String | The ID of the user, service principal, or managed identity. This is an Identity Attribute that must not be changed. Note objectId is a concatenation of the Service Principal (SPN) Object ID and the corresponding Application Object ID. |
| accountEnabled | Boolean | This is set to true if the user, service principal, or managed identity is enabled. Otherwise, this is set to false. |
| spn_appDisplayName | String | The display name for the application. |
| spn_app_Description | String | This is a free-text field for providing the description of the application object to end users. The maximum size is 1024 characters. |
| spn_appId | String | This is the unique identifier for the application that is assigned to an application by Microsoft Entra. |
| spn_applicationTemplateId | String | This is the unique identifier of the application template. |
| spn_appOwnerOrganizationId | String | This contains the tenant ID where the application is registered. |
| spn_createdDateTime | String | This is the date and time the application was registered. |
| spn_homepage | String | This is the home page or landing page of the application. |
| spn_loginUrl | String | Displays the URL where the service provider redirects the user to Microsoft Entra to authenticate. |
| spn_logoutUrl | String | Displays the URL that will be used by Microsoft's authorization service to log out a user. |
| description | String | The description that is displayed in the address book for the user or service principal. |
| displayName | String | The name displayed in the address book for the user or service principal. |
| spn_servicePrincipalType | String | Identifies whether the service principal represents an application, managed identity, or legacy application. |
| spn_signInAudience | Displays the Microsoft accounts that are supported for the current application. | |
| spn_passwordCredentials | String Multi |
The collection of password credentials associated with the service principal. |
| spn_keyCredentials | String Multi |
The collection of key credentials associated with the service principal. |
| spn_tags | String Multi |
The custom strings that can be used to categorize and identify the service principal. |
| spn_app_owners Note Both Users and Applications (corresponding SPN) can be owners. For consistency, the following are shown:
|
String Multi |
Directory objects that are owners of the application. |
| spn_owner Note Only Users can be owners of SPN. For User as SPN Owner spn_owner = <UPN of the User> |
String Multi |
Directory objects that are owners of this servicePrincipal. |
| spn_app_passwordCredentials | Multi | The collection of password credentials associated with the application. |
| spn_app_keyCredentials | Multi | The collection of key credentials associated with the service principal. |
| spn_appRoles | String Multi |
The roles exposed by the application that this service principal represents. |
| appRoleAssignments | applicationRole Multi |
Lists the associated application roles for the Account. This is a multi-valued, entitlement, and managed attribute. |
| groups | group Multi |
Lists the associated groups for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| roles | roles Multi |
Lists the associated Microsoft Entra Roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureRoleAssignments | azureRoleAssignment Multi |
Lists the associated RBAC roles for the user, service principal, or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| spn_adminConsentedPermissions | adminConsentedPermission Multi Entitlement |
Lists the associated Azure admin consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute. |
| spn_userConsentedPermissions | String Multi Entitlement |
Lists the associated Azure user consented permissions for the service principal. This is a multi-valued, entitlement, and managed attribute. |
Note
The Service Principal object will also display Application object properties. Attributes with app in the name are Application object properties and all others are Service Principal object properties.
For example,
- spn_app_owners is for directory objects that are owners of the application.
- spn_owners is for directory objects that are owners of this service principal.
User-Assigned Managed Identity Attributes
You can automate the process of adding user-assigned managed identities account attributes to the account schema, with the toggle option for User Assigned Managed Identities during Account Schema configuration. This reduces your efforts by automating the user-assigned managed identities account attributes addition process. It allows the segregation of various feature management attributes within account schema for better retreival.
Important
Ensure Manage User-Assigned Managed Identities as Accounts during User-Assigned Managed Identities Management configuration is selected to manage user-assigned identities.
Select Include Attributes in Schema for managing user-assigned managed identities to automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration.
To manage user-assigned managed identities, following lists the attributes that are present in the account schema:
| Attribute Name | Description |
|---|---|
| objectId | ID of the user or managed identity. |
| managedIdentity_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity_tags | Tags for the managed identity resource. |
| managedIdentity_type | The type of managed identity resource. |
| managedIdentity_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
System-Assigned Managed Identity Attributes
You can automate the process of adding system-assigned managed identities account attributes to the account schema, with the toggle option for System-Assigned Managed Identities during Account Schema configuration. This simplifies your workflow by automating the system-assigned managed identities account attributes addition process. It enables organized segregation of system-assigned identity-related attributes within the account schema for more efficient retrieval.
Important
Ensure Include System-Assigned Managed Identities during Cloud Resource Management configuration is selected to manage system-assigned identities.
Select Include Attributes in Schema for managing system-assigned managed identities to automate the process of adding system-assigned managed identities account attributes to the account schema during Account Schema configuration.
To manage system-assigned managed identities, following lists the attributes that are present in the account schema:
| Attribute Name | Description |
|---|---|
| objectId | ID of the user or managed identity. |
| managedIdentity_location | The geolocation where the managed identity lives. |
| displayName | The display name of the user or managed identity. |
| managedIdentity_tags | Tags for the managed identity resource. |
| managedIdentity_type | The type of managed identity resource. |
| managedIdentity_principalId | The ID of the service principal object associated with the managed identity. |
| managedIdentity_associatedResources | Lists the associated Azure resources for the managed identity. This is a multi-valued attribute. |
| azureRoleAssignements | Lists the associated RBAC roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| groups | Lists the associated groups for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| azureActiveRoles | Lists the associated Azure active roles for the user or managed identity. This is a multi-valued, entitlement, and managed attribute. |
| managedIdentity_tenantId | The Azure Active Directory (AAD) tenant ID associated with the managed identity. This uniquely identifies the directory where the resource resides. |
| managedIdentity_resourceName | The name of the Azure resource (e.g., a Storage Account, App Service, etc.) to which the managed identity is attached. |
| managedIdentity_resourceType | The resource type identifies the service provider and the specific type of the resource. |
| managedIdentitiy_resourceKind | The kind of the Azure resource, providing additional classification or capabilities. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.