This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 83%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESB%3C/text%3E%3C/svg%3E)
Unable to Assign Service Principle (SPN) Contributor Role to Tenant Management Group
I see SPN as Application in select member.
Why Type is APP (Not SPN)
Look at icon for ansible. It is also Service Principle.
Thats expected. Once you assign it, it will show in the role assignment in IAM as a service principal "Type"
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 30%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
Hello @Shrikant Bhagwat ,
Thank you for reaching out Microsoft Q&A.
Based on your description, when you attempt to add a role assignment to the service principal, it appears as Type: App. As Andy mentioned, this is expected behavior. Once the role is assigned to the app, it will appear under Role Assignments in IAM as a Service Principal (Type).
Regarding Your Second Question: Did Microsoft Changed the Icon?
There is no change in Icons. It is an expected behavior. When you assign a role to a Service Principal at the Subscription Level, it displays a Key Icon. When you assign a role at the Root Management Group Level, it shows an Entra ID Icon (Managed Identities as you described) in the Role Assignment section.
Please refer to the screenshot below for a visual comparison.
I hope this information is helpful. Please feel free to reach out if you have any further questions.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
See the Icons of SPN (Service Principle Names). At places roles are applied at Management Group Level (Tenant Root) & other place Role is added at Resource Group Level
Hello @Shrikant Bhagwat ,
Thank you for reaching out Microsoft Q&A.
As per the mentioned below Screen Shot it is an expected behavior, for the first service principle when you apply the scope at the Management Group level (Tenant Root), the symbol with Entra and the key appears. For the Second service principle when the scope is applied at resource level, the resource icon will appear. For the third service principle when you apply scope at Subscription level the symbol with key appears. The icon displayed depends on the scope you assign for the service principle.
As I specified this is an expected behavior, you can also check the symbols in the document provided. Follow the below document for icon updates and after downloading the icons, navigate to the "Icons" section and check the "General" and "Identity" folders for the icons.
https://learn.microsoft.com/en-us/azure/architecture/icons/#icon-terms
Hope this helps. Do let us know if you any further queries.