Microsoft principals

If you register an application in the portal, an application object as well as a service principal object are automatically created in your home tenant.

An Azure AD application is defined by its one and only application object, which resides in the Azure AD tenant where the application was registered known as the application's "home" tenant.

An application object is used as a template or blueprint to create one or more service principal objects. A service principal is created in every tenant where the application is used.

Similar to a class in object-oriented programming, the application object has some static properties that are applied to all the created service principals or application instances. The application object describes three aspects of an application: how the service can issue tokens in order to access the application, resources that the application might need to access, and the actions that the application can take. You can use the App registrations blade in the Azure portal to list and manage the application objects in your home tenant.

The Microsoft Graph Application entity defines the schema for an application object's properties. To access resources that are secured by an Azure AD tenant, the entity that requires access must be represented by a security principal. This requirement is true for both users user principal and applications service principal. Application - The type of service principal is the local representation, or application instance, of a global application object in a single tenant or directory.

In this case, a service principal is a concrete instance created from the application object and inherits certain properties from that application object. A service principal is created in each tenant where the application is used and references the globally unique app object. The service principal object defines what the app can actually do in the specific tenant, who can access the app, and what resources the app can access.

When an application is given permission to access resources in a tenant upon registration or consent , a service principal object is created. Our mission in action. Innovation We believe technology can and should be a force for good and that meaningful innovation can and will contribute to a brighter world in big and small ways. Check out the latest research Explore innovation stories. Windows and the Windows Server operating systems have built-in user accounts, or you can create user accounts to meet the requirements of your organization.

A security group is a collection of user accounts, computer accounts, and other groups of accounts that can be managed as a single unit from a security perspective. In Windows operating systems, there are several built-in security groups that are preconfigured with the appropriate rights and permissions for performing specific tasks.

Additionally, you can and, typically, will create a security group for each unique combination of security requirements that applies to multiple users in your organization. Local groups exist in the SAM database on local computers on all Windows-based computers except domain controllers. You use local groups to manage rights and permissions only to resources on the local computer.

Simplify administration. You can assign a common set of rights, a common set of permissions, or both to many accounts at one time, rather than assigning them to each account individually. Also, when users transfer jobs or leave the organization, permissions are not tied to their user accounts, making permission reassignment or removal easier. Implement a role-based access-control model. You can use this model to grant permissions by using groups with different scopes for appropriate purposes.

Scopes that are available in Windows include local, global, domain local, and universal. Minimize the size of access control lists ACLs and speed security checking.

In an environment with more than a few thousand users, if the SIDs of individual user accounts are used to specify access to a resource, the ACL of that resource can become unmanageably large, and the time that is needed for the system to check permissions to the resource can become unacceptable.

For descriptions and settings information about the domain security groups that are defined in Active Directory, see Active Directory Security Groups. For descriptions and settings information about the Special Identities group, see Special Identities. Skip to main content. This browser is no longer supported.

Download Microsoft Edge More info. Contents Exit focus mode. Please rate your experience Yes No. Any additional feedback? Submit and view feedback for This product This page. Powered by. Compare Microsoft with. Google 4. Expedia Group 3. Oracle 3. Facebook -. T-Mobile 3. Apple 4. Nokia 4. Zones 2. Questions about Microsoft How should dress for an interview?

If you were in charge, what would you do to make Microsoft a better place to work? How are the working hours at Microsoft? What is the work environment and culture like at Microsoft? What is the interview process like at Microsoft? What tips or advice would you give to someone interviewing at Microsoft? Do Microsoft get paid weekly or monthly? What are the differenc… 9 people answered. Is there difficult to get job in Microsoft company, for example in my case I have associate degree i… 7 people answered.

Does Microsoft allow Network Architects to work from home, if they are not near Redmond, and cannot … 7 people answered. Career recommendations for Principal Explore information on salaries, job satisfaction, skills and more Working as Principal Career advice Salaries and benefits Frequently asked questions Job openings Explore other careers.

See more related careers. Discussion topics at Microsoft Professional development. Mission and values. PTO and work-life balance. Work from home. Parents and caregivers.