We have a number of legacy applications that use LDAP for authnz, and so after moving to AAD we needed to have an LDAP endpoint. Azure AD Domain Services (AADDS) was installed to synchronise to LDAP, which is working and allows users to auth against LDAP in these applications.
Some applications require their own identity to use for binding against the LDAP, so I created a "Service Principal" for this purpose. However, the AADDS synchronisation only appears to synchronise User accounts and Groups, under the "AADDC Users" OU. How do I get Service Principals to synchronise? The only current workaround is to create a User account for this purpose.
Short answer: You can't: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization
Your workaround is valid, however the prefered method for this is to create a group managed service account (gMSA): https://docs.microsoft.com/en-us/azure/active-directory-domain-services/create-gmsa