A service principal is the identity an application holds inside a tenant: when an app is granted permissions or added to groups, the service principal is the object doing the holding. Directories increasingly contain as many application identities as human ones.
Service principals in groups#
Groups are used to grant applications access to resources the same way they grant users, so service principals appear as group members alongside people. That is legitimate and common, and it means member lists can no longer be read as lists of people.
For structure analysis the consequence is typing: a service principal member must not be counted as a user for licensing questions, and must never be mistaken for a nested group when computing hierarchy.
VisualizerEngine
Service principals in VisualizerEngine
Sync types every member correctly, distinguishing users, devices, nested groups, service principals, and contacts, so application identities are visible as what they are and the nesting structure stays accurate.