topic Re: restrict workspace admin from creating service principal in Administration & Architecture

restrict workspace admin from creating service principal

antonionuzzo — Fri, 02 May 2025 08:19:58 GMT

Hello,

I would like to restrict workspace admins from creating service principals and leave this privilege only to the account admin. Is this possible? I am aware of the RestrictWorkspaceAdmins command, but it does not meet my needs. Additionally, I have looked into the possibility of monitoring the management of service principals through the auditLog tables, but I would like to understand if it is possible to delegate the creation of service principals exclusively to the account admin.

Re: restrict workspace admin from creating service principal

Advika — Fri, 02 May 2025 13:05:03 GMT

Hello @antonionuzzo!

Based on the documentation and my understanding, there isn’t a built-in way to restrict the creation of service principals exclusively to account admins. And as you mentioned, the RestrictWorkspaceAdmins setting doesn’t cover this specific permission. For now, the best approach is to monitor service principal activity through audit logs and enforce internal policies to manage this access.