Yeah, that's what I mean, thanks for confirming.

I expect, that, if I am able to create the service principal under the main Terraform identity, I should be able to configure its parameters as well (workspace privileges, secrets, Git configuration, etc). So if I need to run Terraform under the identity of the created SP, then what's the point? it's not quite the IaC I need.