How does it work?
According to Microsoft, a service principal is the local representation of an application object in a tenant. It is the identity of the application instance. A multi-tenant application gets one service principal in each tenant where it is used, and the service principal is created when a user from that tenant consents to the application.
A service principal proves who it is with a client certificate or a client secret. Microsoft recommends certificates when possible, because they are more secure than client secrets.
Why does it matter?
A service principal acts without a person. If an attacker gets its secret, the attacker can sign in as the application and use whatever access it was granted. MITRE describes a related technique, Additional Cloud Credentials (T1098.001), where adversaries add their own credentials, such as keys or passwords, to an application’s service principal alongside the legitimate ones to keep persistent access. For a November 2026 case where stolen app secrets were used to sign in as service principals, see our audit playbook for Entra ID app credentials.
Microsoft also lists over-permissioned service principals and hard-coded shared secrets among the common challenges.
How do you defend against it?
- List the applications and service principals in your tenant and remove the ones you no longer use.
- Give each one only the permissions its task needs.
- Prefer certificates over client secrets and keep them in a vault.
- Watch service principal sign-ins in the Entra sign-in logs, and watch for changes to their credentials.
- Limit who can consent to new multi-tenant applications.
Brandefense External Attack Surface Management helps teams find unknown internet-facing assets, including cloud assets, that can lead to this kind of access.
Also Called
- Application identity
- Enterprise application
Frequently Asked Questions
What is a service principal?
A service principal is the identity an application uses in a Microsoft Entra tenant. According to Microsoft, it is the local representation of an application object and defines what the application can access.
How does a service principal sign in?
It uses a client certificate or a client secret. Microsoft recommends certificates when possible.
Why do attackers target service principals?
A service principal acts without a person. MITRE describes adversaries adding their own credentials to a service principal (T1098.001) to keep access.
How can teams reduce the risk?
Grant least privilege, prefer certificates and keep them in a vault, limit user consent, and monitor service principal sign-ins and credential changes, as Microsoft advises. Removing applications you no longer use also reduces the risk.
