"IdentityId","Name","Type","Spns","Enabled","Risk","CandidateTarget"
"ad:ad000000-0000-4000-8000-000000000002","svc-sqlprod","Traditional","MSSQLSvc/sql01.corp.contoso.example:1433","True","HIGH","Data Platform plan (SPN MSSQLSvc/sql01.corp.contoso.example:1433): gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)"
"ad:ad000000-0000-4000-8000-000000000008","svc-ldapbind","Traditional","","True","MEDIUM","Data Platform plan (name matches *ldapbind*): Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate"
"ad:ad000000-0000-4000-8000-000000000023","gmsa-sql$","gMSA","MSSQLSvc/sql02.corp.contoso.example:1433","True","MEDIUM","Data Platform plan (SPN MSSQLSvc/sql02.corp.contoso.example:1433): Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves"
