# Service Principals and Managed Identities

## Service Principal Account Management

To access resources that are secured by the Microsoft Entra tenant, the entity that requires access must be represented by a security principal. This requirement is true for both users (user principal) and applications (service principal). The security principal defines the access policy and permissions for the user/ application in the Microsoft Entra tenant. With this feature, the connector supports managing such service principals for enterprise applications as accounts.

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

> [!NOTE]
>
> To gauge the probability of compromised service principals (workload identities) accounts in your environment. Refer to [Risky Service Principal Alert Feature](<#risky-service-principal-alert-feature>) for more information.

### Supported Operations

The following operations are supported for the azure service principal:

<table class="span-table"> <tr> <td>Operations</td> <td>Service Principal</td> </tr> <tr> <td>Aggregation</td> <td colspan="1" rowspan="6">Yes</td> </tr> <tr> <td>Get Account</td> </tr> <tr> <td>Create</td> </tr> <tr> <td>Update</td> </tr> <tr> <td>Enable and Disable Users</td> </tr> <tr> <td>Add and Remove Entitlements<br><ul><li>Add and Remove Roles</li><li>Add and Remove User's Group Membership</li><li>Add and Remove Application Role Memberships (<code>appRoleAssignments</code>)</li><li>Add and Remove RBAC Role Memberships (<code>azureRoleAssignments</code>)<br>Note <br>For more details and the required prerequisites, refer to <a href="https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management">Group Management for Azure Cloud Objects</a>.</li><li>Add and Remove Admin Consented Delegated Permissions (<code>spn_adminConsentedPermissions</code>)</li><li>Remove User Consented Delegated Permissions (<code>spn_userConsentedPermissions</code>)</li></ul></td> </tr> </table>

### Administrator Permissions

| Purpose | Type | Permissions |
| --- | --- | --- |
| Aggregation of Service Principals | Application | Application.Read.All |
| Create and Update Service Principals | Application | Application.ReadWrite.All |
| Add and Remove Owners | Application | Application.ReadWrite.OwnedBy |
| Add and Remove Application Roles for Service Principals | Application | AppRoleAssignment.ReadWrite.All |
| Aggregation of Application Roles | Application | Application.Read.All |
| Aggregation and Add/Remove Microsoft Entra ID Group and Roles for Service Principals |  | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Service Principals |  | Refer to [Group Attributes for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/pim_cloud_objects.html#group-attributes-for-azure-cloud-objects>). |
| Aggregation of Admin/User Consented Permissions for Service Principals | Application | DelegatedPermissionGrant.Read.All |
| Add/Remove Admin Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |
| Remove User Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All |

### Supported Schema Attributes

To aggregate service principal related information for the user during account aggregation, ensure that the service principal attributes are present in the account schema. For more information, refer to [Service Principal as Accounts Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#service-principal-as-accounts-attributes>).

### Supported Provisioning Attributes

To provision service principal related information, ensure that the attributes in [Account Profile for Service Principal](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/azure_policies.html#account-profile-for-service-principal>) are present in your provisioning policy.

### Configure Microsoft Entra Service Principals As Accounts in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/feat_man.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/feat_man.png>)

1. Go to **Feature Management**.
2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list.
3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'`

   > **Note**
   >
   > Advanced queries are not supported.

   Example filters:

   - For a filter to match the Enterprise Application default view on the Azure portal use the following:

     `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')`
4. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal.
5. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal.
6. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra ID Group memberships for Service Principal.
7. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals.
8. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals.

   > **Note**
   >
   > This is for delegated permissions.
9. Select **Save**.

### Risky Service Principal Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised service principals (workload identities) accounts in your environment. A service principal flagged for risk is an indicator of a service principal account that might have been compromised. The risky service principal represents the probability that a given service principal (workload identity) is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

> [!NOTE]
>
> - Before utilizing Risky Service Principal Alert feature, ensure that Service Principals are configured as accounts in the source. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>).
> - By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky Service Principal Alert feature, you must enable the feature by adding attributes to the Account Schema in the SailPoint user interface.

#### Supported Operations

This feature supports the following operations:

- Account Aggregation (Service Principal Aggregation)
- Get Object (Get Service Principal)

#### Prerequisites

The tenant must have a Microsoft Entra P2 license.

#### Administrator Permissions

To fetch risky service principal details using MS Graph APIs, the following API permissions must be assigned:

| OAuth2.0 Authentication | Type | Permission | Purpose |
| --- | --- | --- | --- |
| Client Credentials | Application | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |
| Refresh Token / AuthCode<br>JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All<br>IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information |

#### Supported Schema Attributes

To manage the risky service principal alert feature, ensure that the following attributes are present in the account schema:

> [!NOTE]
>
> The account schema cannot be extended for other risk related attributes.

| Attribute Name | Description |
| --- | --- |
| spn\_riskLevel | Level of the detected risky service principal. |
| spn\_riskState | State of the service principal's risk. |
| spn\_riskDetail | Details of the detected risk. |
| spn\_riskLastUpdatedDateTime | The date and time when the risky service principal was last updated. |

## Managed Identity Management

Managed identities for Azure resources offer a secure and convenient way for Azure services to authenticate to other Azure services that support Microsoft Entra ID authentication, without the need to manage or store credentials in the code.

### User-Assigned Managed Identities

Managed identities for Azure resources provide Azure services with an automatically managed identity in Microsoft Entra ID. These identities can be used to authenticate to any Azure service that supports Microsoft Entra ID authentication, without having credentials in the code. SailPoint supports managing only user-assigned managed identities as they have an independent lifecycle.

The following operations are supported for user-assigned managed identity objects:

- Aggregation of user-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

#### Prerequisites

If you want to configure your source to aggregate managed identities, you need to modify the account schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as `Account Name`.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate user-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).

#### Configure User-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat2.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/az_ad_feat2.png>)

1. Go to **Feature Management**.
2. Select the **Manage User-Assigned Managed Identities as Accounts** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities.

   > **Note**
   >
   > To automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing user-assigned managed identities . For more information, refer to [User-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#user-assigned-managed-identity-attributes>).
3. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities.
4. Select **Save**.

### System-Assigned Managed Identities

SailPoint supports managing system-assigned managed identities, but with limited capabilities due to the tight coupling between the identity and the Azure resource lifecycle.

The following operations are supported for system-assigned managed identity objects:

- Aggregation of system-assigned managed identities in account aggregation.
- Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities.
- Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities.
- Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities. (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license).

> [!NOTE]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment or [Service Principal Account Management](<#service-principal-account-management>)), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.

#### Prerequisites

If you want to configure your source to aggregate managed identities, ensure to modify the Account Schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as Account Name.

#### Correlation for Managed Identities

The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](<https://community.sailpoint.com/knowledge/Service-Accounts-Best-Practices>).

#### Administrator Permissions

| Purpose | Permissions |
| --- | --- |
| Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator<br>OR<br>Role: Reader<br>Scope: Tenant Root Group (to fetch from all subscriptions) |
| Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/prerequisites.html#required-permissions>). |
| Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-cloud-object-management>). |
| Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/supported_features/azure_governance.html#azure-pim-for-roles>). |

**To assign the Reader role at Tenant Root Group:**

1. Sign in to [https://portal.azure.com](<https://portal.azure.com>) and go to **All Services \> Management Groups or \<CU Subscription\> (CU tenant)**.
2. Select the **Tenant Root Group**.
3. On the left-hand side of the screen, select **Access Control (IAM)**.
4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource.

#### Supported Schema Attributes

To aggregate system-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [System-Assigned Managed Identity Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/workload_identity_attributes.html#system-assigned-managed-identity-attributes>).

#### Configure System-Assigned Managed Identities in Source

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/system_assigned_identities.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/system_assigned_identities.png>)

1. Go to **Feature Management**.
2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for system-assigned managed identities.
3. Select the **Include System-Assigned Managed Identities** checkbox to manage system-assigned identities.
4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for system-assigned managed identities.
5. Select **Save**.