# Service Principals and Managed Identities ## Service Principal Management As an Entitlement Entra Service Principals are a security identity used by user-created applications, services, and automation tools to access specific Entra resources. A Service Principal is a user identity (login and password or certificate) with a specific role, and controlled permissions to access your resources. To improve security, only grant the minimum permission level to perform management tasks. > [!NOTE] > > The Microsoft Entra ID connector has the capability to manage Service Principals as Account, which is the recommended approach. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>). When creating new instances of the Microsoft Entra ID connector, the configuration will not have the group schema for the Service Principal object (i.e., the `servicePrincipal` object type schema). The associated entitlement attribute entry from the account schema has also been removed (i.e., the `servicePrincipals` account schema attribute). Backward compatibility is maintained with this feature. If you want to utilize the feature with new connectors, make the schema changes in accordance with the information in the [Service Principal]() topic. The following operations are supported for the ServicePrincipal object type: - Aggregation - View details of ServicePrincipal (like object properties, members and so on) - Provision and Revoke access request for ServicePrincipal > [!NOTE] > > Aggregating Service Principal entitlements negatively impacts account aggregation performance. ### Enabling Feature on Existing Connectors 1. Modify the existing account schema and add the Service Principal related attributes as mention in the [Service Principal Attributes]() topic. 2. Remove the existing group schema for the "Service Principal" object. 3. Add a new group schema "Application Role" object as mentioned in the [Application Role Attributes]() topic. 4. After making the schema changes, perform account and group aggregation. 5. Modify the existing Create Account Policy to include the Service Principal attributes as mentioned in the [Account ProfileCreate Policy for Service Principal]() topic. ## Service Principal Account Management > [!IMPORTANT] > > If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information. To access resources that are secured by an Microsoft Entra ID tenant, the entity that requires access must be represented by a security principal. This requirement is true for both users (user principal) and applications (service principal). The security principal defines the access policy and permissions for the user/application in the Microsoft Entra ID tenant. With this feature, the connector supports managing such Service Principals for enterprise applications as Accounts. > [!NOTE] > > To gauge the probability of compromised service principals (workload identities) accounts in your environment, refer to [Risky Service Principal Alert Feature](<#risky-service-principal-alert-feature>) for more information. > [!CAUTION] > > Switching from Service Principal Group Management to Service Principal Account Management may invalidate previously created Service Principal Managed Attribute objects. Ensure a thorough review of configurations before making this change to avoid potential data issues in your environment. ### Supported Operations The following operations are supported for the azure service principal:
Operations Service Principal
Aggregation Yes
Get Account
Create
Update
Enable and Disable Users
Add and Remove Entitlements
  • Add and Remove Roles
  • Add and Remove User's Group Membership
  • Add and Remove Application Role Memberships (appRoleAssignments)
  • Add and Remove PIM Role Memberships (azureActiveRoles and AzureADActiveRoles)
  • Add and Remove RBAC Role Memberships (azureRoleAssignments)
    Note
    For more details and the required prerequisites, refer to Group Management for Azure Cloud Objects.
  • Add and Remove Admin Consented Delegated Permissions (spn_adminConsentedPermissions)
  • Remove User Consented Delegated Permissions (spn_userConsentedPermissions)
### Administrator Permissions | Purpose | Type | Permissions | | --- | --- | --- | | Aggregation of Service Principals | Application | Application.Read.All | | Create and Update Service Principals | Application | Application.ReadWrite.All | | Add and Remove Owners | Application | Application.ReadWrite.OwnedBy | | Add and Remove Application Roles for Service Principals | Application | AppRoleAssignment.ReadWrite.All | | Aggregation of Application Roles | Application | Application.Read.All | | Aggregation and Add/Remove Microsoft Entra ID Group and Roles for Service Principals | | Refer to [Required Permissions](). | | Aggregation and Add/Remove RBAC Roles for Service Principals | | Refer to [Group Attributes for Azure Cloud Objects](). | | Aggregation and Add/Remove PIM Azure Active and Microsoft Entra ID Roles for Service Principals | | Refer to [Azure Privileged Identity Management (PIM)](). | | Aggregation of Admin/User Consented Permissions for Service Principals | Application | DelegatedPermissionGrant.Read.All | | Add/Remove Admin Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All | | Remove User Consented Delegated Permissions for Service Principals | Application | DelegatedPermissionGrant.ReadWrite.All | ### Supported Schema Attributes To aggregate service principal related information for the user during account aggregation, ensure that the service principal attributes are present in the account schema. For more information, refer to [Service Principal as Accounts Attributes](). ### Supported Provisioning Attributes To provision service principal related information, ensure that the attributes in [Service Principal Profile Provisioning Policy Attributes]() are present in your provisioning policy. ### Configuring Microsoft Entra Service Principals As Accounts > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. > **Note** > > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](). 3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'` > **Note** > > Advanced queries are not supported. Example filters: - For a filter to match the Enterprise Application default view on the Azure portal use the following: `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')` 4. Select the **Manage Azure PIM Role Memberships** checkbox to manage Azure PIM Active Role memberships for Service Principal. 5. Select the **Manage Microsoft Entra PIM Role Memberships** checkbox to manage Microsoft Entra ID PIM Active Role memberships for Service Principal. 6. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal. 7. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal. 8. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra ID Group memberships for Service Principal. 9. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals. 10. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals. > **Note** > > This is for delegated permissions. 11. Select **Save**. ### Risky Service Principal Alert Feature With the security reports in Microsoft Entra, you can gauge the probability of compromised service principals (workload identities) accounts in your environment. A service principal flagged for risk is an indicator of a service principal account that might have been compromised. The risky service principal represents the probability that a given service principal (workload identity) is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources. > [!NOTE] > > - Before utilizing Risky Service Principal Alert feature, ensure that Service Principals are configured as accounts in the source. For more information, refer to [Service Principal Account Management](<#service-principal-account-management>). > - By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky Service Principal Alert feature, you must enable the feature by adding attributes to the Account Schema in the SailPoint user interface. #### Supported Operations This feature supports the following operations: - Account Aggregation (Service Principal Aggregation) - Get Object (Get Service Principal) #### Prerequisites The tenant must have a Microsoft Entra P2 license. #### Administrator Permissions To fetch risky service principal details using MS Graph APIs, the following API permissions must be assigned: | OAuth2.0 Authentication | Type | Permission | Purpose | | --- | --- | --- | --- | | Client Credentials | Application | IdentityRiskEvent.Read.All
IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information | | Refresh Token / AuthCode
JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All
IdentityRiskyServicePrincipal.Read.All | Aggregate or get risky service principal related information | #### Supported Schema Attributes To manage the risky service principal alert feature, ensure that the following attributes are present in the account schema: > [!NOTE] > > The account schema cannot be extended for other risk related attributes. | Attribute Name | Description | | --- | --- | | spn\_riskLevel | Level of the detected risky service principal. | | spn\_riskState | State of the service principal's risk. | | spn\_riskDetail | Details of the detected risk. | | spn\_riskLastUpdatedDateTime | The date and time when the risky service principal was last updated. | ## Managed Identities Managed identities for Azure resources offer a secure and convenient way for Azure services to authenticate to other Azure services that support Microsoft Entra ID authentication, without the need to manage or store credentials in the code. ### User-Assigned Managed Identities SailPoint supports managing user-assigned managed identities as they have an independent lifecycle. The following operations are supported for user-assigned managed identity objects: - Aggregation of user-assigned managed identities in account aggregation. - Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities. - Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities. - Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license). #### Prerequisites If you want to configure your source to aggregate managed identities, you need to modify the account schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as `Account Name`. #### Correlation for Managed Identities The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](). #### Administrator Permissions | Purpose | Permissions | | --- | --- | | Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator
OR
Role: Reader
Scope: Tenant Root Group (to fetch from all subscriptions) | | Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](). | | Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](). | | Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](). | **To assign the Reader role at Tenant Root Group:** 1. Sign in to [https://portal.azure.com]() and go to **All Services \> Management Groups or \ (CU tenant)**. 2. Select the **Tenant Root Group**. 3. On the left-hand side of the screen, select **Access Control (IAM)**. 4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource. #### Supported Schema Attributes To aggregate user-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [User-Assigned Managed Identity Attributes](). #### Configure User-Assigned Managed Identities in Source > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities. 3. Select the **Include User-Assigned Managed Identities** checkbox to manage user-assigned identities. 4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities. 5. Select **Save**. ### System-Assigned Managed Identities SailPoint supports managing system-assigned managed identities, but with limited capabilities due to the tight coupling between the identity and the Azure resource lifecycle. The following operations are supported for system-assigned managed identity objects: - Aggregation of system-assigned managed identities in account aggregation. - Aggregation of assigned Microsoft Entra ID groups as an entitlement during account aggregation, and add or remove Microsoft Entra ID groups to or from managed identities. - Aggregation of assigned PIM roles (only Azure Active Roles) as an entitlement during account aggregation, and add or remove PIM roles (only Azure Active Roles) to or from managed identities. - Aggregation of assigned Azure Role Assignments (RBAC) as an entitlement during account aggregation, and add or remove Azure Role Assignments (RBAC) to or from managed identities. (This feature requires a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license). #### Prerequisites If you want to configure your source to aggregate managed identities, ensure to modify the Account Schema to define any of the managed identity attributes as `Account Name`. For example, the `displayName` attribute of the managed identity can be tagged as Account Name. #### Correlation for Managed Identities The existing out-of-the-box correlation rule does not work directly for managed identities correlation, as it is defined using the Microsoft Entra ID user attributes. You must modify it using the attributes for managed identities. Otherwise, there are different ways to manage identities for these service accounts. For more information, refer to [Best Practices: Managing Service Accounts](). #### Administrator Permissions | Purpose | Permissions | | --- | --- | | Aggregation and Assignment of Managed Identities | Role: Managed Identity Operator
OR
Role: Reader
Scope: Tenant Root Group (to fetch from all subscriptions) | | Aggregation and Add/Remove Microsoft Entra ID Groups for Managed Identities | Refer to [Required Permissions](). | | Aggregation and Add/Remove RBAC Roles for Managed Identities | Refer to [Group Management for Azure Cloud Objects](). | | Aggregation and Add/Remove PIM Azure Active Roles for Managed Identities | Refer to [Azure Privileged Identity Management (PIM)](). | **To assign the Reader role at Tenant Root Group:** 1. Sign in to [https://portal.azure.com]() and go to **All Services \> Management Groups or \ (CU tenant)**. 2. Select the **Tenant Root Group**. 3. On the left-hand side of the screen, select **Access Control (IAM)**. 4. Select **Role Assignments**, then **\+Add**, and assign the Reader role on the resource. #### Supported Schema Attributes To aggregate system-assigned managed identities during account aggregation, ensure that managed identity attributes are present in the account schema. For more information, refer to [System-Assigned Managed Identity Attributes](). #### Configure System-Assigned Managed Identities in Source > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for system-assigned managed identities. 3. Select the **Include System-Assigned Managed Identities** checkbox to manage system-assigned identities. 4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for system-assigned managed identities. 5. Select **Save**.