Notifications
Clear all
Topic starter
08/07/2026 6:54 pm
TL;DR: Service principals in Microsoft 365, Intune, Defender, and Entra ID can hold standing secrets, broad permissions, and directory roles without MFA or user-facing controls, creating a persistent attack path according to Senserva. That makes workload identity inventory, consent review, and credential expiry core IAM work, not optional hygiene.
NHIMG editorial — based on content published by Senserva: service principal risk in Microsoft 365, Intune, Defender, and Entra ID tenants
Questions worth separating out
Q: How should security teams govern service principals in Entra ID?
A: Start by treating service principals as privileged workload identities, not background configuration objects.
Q: Why do service principals create more risk than many human accounts?
A: Service principals can hold standing credentials and powerful permissions without MFA, Conditional Access, or human sign-in friction.
Q: What do teams get wrong about app registrations and enterprise apps?
A: Many teams assume an app identity is harmless if no one is actively using it.
Practitioner guidance
- Build a separate workload identity inventory List every service principal, then capture its permissions, directory roles, owner, credential type, and expiry.
- Rank application permissions by blast radius Prioritise app registrations with tenant-wide Graph scopes, directory role assignments, or broad admin consent.
- Flag dormant and ownerless identities for removal Treat service principals with no sign-ins in the last 90 days, missing owners, or expired business sponsorship as active risk.
What's in the full article
Senserva's full article covers the operational detail this post intentionally leaves for the source:
- The exact Microsoft 365, Intune, Defender, and Entra ID scan workflow used to inventory app registrations and service principals.
- The specific severity-ranking logic that surfaces risky permissions, dormant identities, and missing owners in a prioritised worklist.
- The validated fix-and-rescan process that shows whether revoked permissions and rotated credentials actually stayed closed.
- How the Senserva MCP supports plain-language queries across service principal risk and compliance mapping.
👉 Read Senserva's analysis of service principal risk in Entra ID tenants →
Service principals in Entra ID: what IAM teams are missing?
Explore further
08/07/2026 7:16 pm
Standing app trust is the real failure mode here: service principals were created for runtime automation, but many tenants still treat them as low-touch setup artifacts. That assumption breaks when an app can hold high-impact permissions indefinitely, especially without MFA, user prompts, or clear ownership. The implication is that workload identity governance must be managed as privileged access governance, not as a developer convenience problem.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
A question worth separating out:
Q: How can organisations tell whether workload identity governance is working?
A: Look for fewer ownerless apps, shorter credential lifetimes, reduced tenant-wide consent, and a shrinking set of high-privilege service principals after each review cycle. If scans keep finding the same identities with the same permissions, the programme is cataloguing risk rather than reducing it.
👉 Read our full editorial: Service principals are the hidden risk in Entra ID tenants
