Principals

A principal is any identity that can be granted access to resources in your cloud provider – a user, a group, a service account, or a federated identity. Troposphere imports the principal directory from every connected cloud provider so you can see who or what has access to your estate, independent of the resources themselves.

Where principals come from#

Principals are discovered automatically on each sync. For Azure connections, Troposphere reads the Microsoft Entra directory via the Graph API permissions granted to the connection’s App Registration, pulling users, groups, and service principals and reconciling them against the connection’s role assignments.

Principals are never created or modified by Troposphere. The data is strictly read-only and reflects what exists in the connected provider.

Principal Types#

Every principal is classified as one of four types:

• User – a human identity in the directory.
• Group – a collection of principals that can be granted access as a unit.
• Service Account – a non-human identity used by applications, workloads, or automation (service principals in Entra ID).
• Federated Identity – an external identity that signs in through a federation trust (for example, workload identity federation).

Principal Statuses#

• Active – the principal exists in the directory and is enabled.
• Disabled – the principal exists but sign-in is disabled.
• Deleted – the principal has been removed from the directory. Troposphere retains the record for historical context.

Role Assignments#

Each principal can hold zero or more role assignments that grant it access at a subscription, resource-group, or resource scope. Troposphere collapses all of these into a unified view so you can see exactly what a given principal can do across every connection.

Certain roles – Owner, Contributor, and User Access Administrator on Azure – are flagged as privileged. Troposphere surfaces how many principals hold each privileged role so you can quickly spot over-provisioned access.