A service principal is the identity an application uses inside a Microsoft Entra tenant. It defines what the application can access, and it signs in with a certificate or a client secret instead of a person's password. Because it has no person behind it, the stolen credentials of a service principal can be abused without a user sign-in prompt.
- Also Called2other namesApplication identity · Enterprise application
- Related Terms3linked entriesNon-human identity · Supply chain attack · Cloud security
How does it work?
According to Microsoft, a service principal is the local representation of an application object in a tenant. It is the identity of the application instance. A multi-tenant application gets one service principal in each tenant where it is used, and the service principal is created when a user from that tenant consents to the application.
A service principal proves who it is with a client certificate or a client secret. Microsoft recommends certificates when possible, because they are more secure than client secrets.
Why does it matter?
A service principal acts without a person. If an attacker gets its secret, the attacker can sign in as the application and use whatever access it was granted. MITRE describes a related technique, Additional Cloud Credentials (T1098.001), where adversaries add their own credentials, such as keys or passwords, to an application’s service principal alongside the legitimate ones to keep persistent access.
Microsoft also lists over-permissioned service principals and hard-coded shared secrets among the common challenges.
How do you defend against it?
- List the applications and service principals in your tenant and remove the ones you no longer use.
- Give each one only the permissions its task needs.
- Prefer certificates over client secrets and keep them in a vault.
- Watch service principal sign-ins in the Entra sign-in logs, and watch for changes to their credentials.
- Limit who can consent to new multi-tenant applications.
Brandefense External Attack Surface Management helps teams find unknown internet-facing assets, including cloud assets, that can lead to this kind of access.
Also Called.
- NameApplication identity
- NameEnterprise application
Questions.
-
What is a service principal?
A service principal is the identity an application uses in a Microsoft Entra tenant. According to Microsoft, it is the local representation of an application object and defines what the application can access.
-
How does a service principal sign in?
It uses a client certificate or a client secret. Microsoft recommends certificates when possible.
-
Why do attackers target service principals?
A service principal acts without a person. MITRE describes adversaries adding their own credentials to a service principal (T1098.001) to keep access.
-
How can teams reduce the risk?
Grant least privilege, prefer certificates and keep them in a vault, limit user consent, and monitor service principal sign-ins and credential changes, as Microsoft advises. Removing applications you no longer use also reduces the risk.
Sources
In Our Research
- 1 Storm-0940 Used ARTEX Against ConnectWise: What Microsoft 365 Admins Should Check October 2026
- 2 LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
- 3 APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse September 2025
- 4 APT29 Threat group
- 5 HAFNIUM Threat group
- 6 Kerberoasting Glossary term