~/moritzsamrock_

Security Principal

Security Principal: A security-relevant identity represented by a SID in Windows access tokens and access control lists. User, computer, and service accounts as well as security groups can participate in authorization decisions as principals. Names can change and are not sufficiently unique; the SID is authoritative for technical identity mapping.

How it works and where it fits

Security Principal separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

  • Active Directory UserActive Directory UserActive Directory object representing a human or technical identity with credentials, attributes, and group memberships.: Active Directory object representing a human or technical identity with credentials, attributes, and group memberships.
  • Active Directory Computer AccountActive Directory Computer AccountSecurity principal representing a domain-joined computer and enabling its authentication and policy relationship.: Security principal representing a domain-joined computer and enabling its authentication and policy relationship.
  • Active Directory GroupActive Directory GroupDirectory object used to assign permissions collectively or to form email distribution lists.: Directory object used to assign permissions collectively or to form email distribution lists.
  • AuthorizationAuthorizationDecision regarding which actions an authenticated identity is permitted to perform.: Decision regarding which actions an authenticated identity is permitted to perform.

Related terms