Service Principal: Your App's Identity
A service principal is an application's identity in a specific security context, like a "robot user." It's the local instance that gets permissions, separate from the app's global blueprint. This is how CI/CD pipelines authenticate to cloud APIs.
Why it exists
Systems need a way for applications and scripts to authenticate and be authorized to access resources without a human user's credentials. A service principal provides a non-human identity for these automated processes, enabling secure, unattended access control.
The mental model
Think of it like a class and an object in programming. The 'Application Object' is the class—a single, global blueprint defining your application. The 'Service Principal' is the object—a concrete instance of that application within a specific environment or directory. This instance is what you actually give a key to and assign permissions.
How it works
When you register an application in a cloud directory (like Microsoft Entra ID), you create one global Application Object. This acts as the template. To use the application in a specific tenant, a Service Principal object is created. This service principal is the security identity that can be authenticated (using a secret or certificate) and authorized (by assigning it roles like 'Reader' or 'Contributor'). For a multi-tenant app, a new service principal is created in each tenant that consents to use it, each with its own distinct permissions.
When to use it
Use a service principal for any non-interactive process that needs to access secured resources. This is the standard for CI/CD pipelines deploying infrastructure, background jobs processing data, or any automated script that needs to call cloud APIs. It allows a program to act on its own behalf.
When not to use it
Do not use a service principal for interactive user sessions where a human is present; use standard user authentication flows for that. For services running on a cloud platform (like a VM or Function App), consider using a Managed Identity, which is a specialized type of service principal where the cloud provider handles credential management automatically.
One canonical example
A GitHub Actions workflow needs to deploy a web app to Azure. You create a service principal in your Azure tenant, grant it the 'Website Contributor' role on the specific web app resource, and store its credentials (client ID, tenant ID, and secret) as secrets in GitHub. The workflow then uses these credentials to authenticate as the service principal and deploy the code without needing a person's password.
Interview question
According to the provided mental model, what best describes the relationship between an "Application Object" and a "Service Principal"?
- a.The Application Object is a global blueprint, and the Service Principal is a concrete instance of that blueprint in a specific directory.Correct
- b.The Application Object defines the application's code, and the Service Principal defines its deployment configuration.
- c.The Application Object manages credentials for the application, and the Service Principal manages its assigned roles.
- d.The Application Object is for interactive user authentication, while the Service Principal is for non-interactive automated processes.
Why? this is the answer
The card explicitly states that the Application Object is the global blueprint (class), and the Service Principal is a concrete instance (object) of that application within a specific environment. Option D describes a common use-case distinction, but not the fundamental object-instance relationship between the two.
Just read this? Test yourself on what you have been reading.
Read the original → learn.microsoft.com
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on cloud — each one lists the topics its interview covers.
See open roles