Inventory service principals
Documentation: Microsoft Learn
List tenant service principals with Microsoft Graph PowerShell. Review application identities and the properties returned by the inventory.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MgServicePrincipal -All -Property DisplayName,AppId,AccountEnabled,ServicePrincipalType | Select-Object DisplayName,AppId,AccountEnabled,ServicePrincipalType- Stage 1Get-MgServicePrincipal
-All -Property - Stage 2Select-Object
Positional values or no named parameters
How it works
List tenant service principals with Microsoft Graph PowerShell. Review application identities and the properties returned by the inventory. The projection keeps the display name with the AppId that identifies the underlying application, AccountEnabled, and ServicePrincipalType, which is what separates an application principal from a managed identity.
Adapting it
Filter on ServicePrincipalType eq 'ManagedIdentity' to review only identities attached to Azure resources, since those and third-party applications raise entirely different questions.
Requirements
Microsoft.Graph module and a Graph session with Application.Read.All.
If the result is unexpected
A service-principal report is confused with the app-registration inventory.
Service principals are tenant instances of applications and are distinct from application objects.
- Compare the service principal object ID and AppId with the relevant application record.
Validate the result
The report labels object IDs and application IDs correctly and includes the intended enterprise application.
Keep the check reliable
Keep application objects and service principals in separate inventory columns or datasets.
