Newbie question: Service Principals created during portal deployment

[zorglob]

I tested the deployment of the Azure Landing Zones in using the portal. Depending on the selections made, various services principals are created and assigned to the top management group and some at the subscription levels with different roles.
There is also in my case an user-assigned managed identity (id-ama-prod-northeurope-001) that was created and does not seem to be associated to anything.
Can they be removed after the initial deployment. How are they used?

I feel sorry for the questions. Thanks in advance!

[jtracey93]

Hey @zorglob,

No worries happy to answer.

So all the SPNs you see at the top management group, and they will also be on other management groups, are for the policy assignments that require permissions to complete remediation tasks. Please dont remove these as it will stop the policies from being able to work as designed. This is documented further here: https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#why-are-managed-identities-deployed-as-part-of-the-alz-policies

The identity id-ama-prod-northeurope-001 is used for the Azure Monitor Agent and is critical for this to work, so please dont remove this either. Again this is documented further here https://github.com/Azure/Enterprise-Scale/wiki/ALZ-AMA-FAQ#why-do-i-need-a-user-assigned-managed-identity