restrict workspace admin from creating service principal

[antonionuzzo]

Hello,

I would like to restrict workspace admins from creating service principals and leave this privilege only to the account admin. Is this possible? I am aware of the RestrictWorkspaceAdmins command, but it does not meet my needs. Additionally, I have looked into the possibility of monitoring the management of service principals through the auditLog tables, but I would like to understand if it is possible to delegate the creation of service principals exclusively to the account admin.

[Advika]

Hello @antonionuzzo!

Based on the documentation and my understanding, there isn’t a built-in way to restrict the creation of service principals exclusively to account admins. And as you mentioned, the RestrictWorkspaceAdmins setting doesn’t cover this specific permission. For now, the best approach is to monitor service principal activity through audit logs and enforce internal policies to manage this access.