Principal

As explained in Azure Security

A security principal is an identity or identity-bearing entity, such as a user, group, service principal, or managed identity, that can receive permissions in an authorization system.

A principal is the identity attempting to authenticate to a resource. In Azure RBAC, a security principal is the “who” that receives permissions for Azure resources: a user, group, service principal, or managed identity. section 2.2 section 2.3.2

Authentication verifies the principal’s identity. The principal presents a credential, such as a password or certificate, and successful authentication produces tokens used to grant access to a resource. Avoid designs where every resource stores principal credentials: a breached resource can expose reused passwords to further attacks. section 2.2 section 2.2

Use the principal as the starting point for an Azure RBAC decision:

• Identify the user, group, application service principal, or managed identity that needs access. section 2.3.2
• Choose a role definition that states the allowed actions, such as read, write, or delete. section 2.3.2
• Create a role assignment that binds that principal and role definition at the required scope. section 2.3.3
• Remove the role assignment when access is no longer required. section 2.3.3

Granting application access

An application needing a storage account can be represented by a service principal; a managed identity can also be a security principal. Assign the needed role at the appropriate resource scope rather than treating the application itself as its permissions. section 2.3.2 section 2.3.3

Figure 2.10 Core components of role assignments in Azure RBAC

This diagram links the three parts of an Azure RBAC grant: the security principal, role definition, and scope. section 2.3.3

How Azure Security covers it

How deep it goes

Defines principals in authentication and Azure RBAC, then relates them to credentials, tokens, roles, scopes, and assignments.

Examples

Uses a user, administrator group, storage-account application, managed identity, and Virtual Machine Contributor assignment.

What it assumes

Explains principals from authentication and introduces their Azure RBAC role without stated prior requirements.

What you can do after

Operate/configure it by assigning or removing Azure RBAC roles for a selected principal and scope.

How it connects

Connects principals with authentication, credentials, tokens, resources, role definitions, scopes, and role assignments.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionA principal is an entity, such as a person, machine, or process, that can initiate an action in an authorization system.
• 

  liveBookmanning.com
  Microsoft Azure in ActionA security principal is an identity-bearing object, such as a user, group, or application, that can request access to an Azure resource.
• 

  liveBookmanning.com
  Apache Kafka in ActionA principal is the authenticated security identity representing a user or system when accessing protected resources.
• 

  liveBookmanning.com
  Kafka for ArchitectsA principal is an identity representing a client, broker, user, or service in a security system.

Compare how 5 books explain principal →

Related concepts

• role assignmentpart of · A role assignment is an access-control configuration that grants a principal an authorization role or specified permissions for a defined scope.
• PARC modelpart of · The PARC model is an authorization framework that describes an access decision using a principal, action, resource, and conditions or context.
• ClaimsPrincipalimplemented by · ClaimsPrincipal is a .NET security class representing a principal through one or more identities and their associated claims.
• policy templateused by · A policy template is a reusable authorization policy structure containing placeholders that are filled with specific principals, resources, or other values later.
• subjectcontrasts with · A subject is an entity designated as the focus of representation, data modeling, or an authorization policy.
• role-based access controluses · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.