I have a hard time understanding the lifetime of the service principal created in Azure AD when creating the service connection between Azure DevOps and Azure. I do it like this:

I pick the Azure Resource Manager
[![Choosing the ARM connection manager](https://i.stack.imgur.com/xfDbi.png)](https://i.stack.imgur.com/xfDbi.png)

And then i choose the recommended
[![Recommended approach](https://i.stack.imgur.com/WMoC3.png)](https://i.stack.imgur.com/WMoC3.png)

Hereafter I fill in the blanks
[![Service connection create](https://i.stack.imgur.com/9Reeg.png)](https://i.stack.imgur.com/9Reeg.png)

I now have a valid service connection and I can deploy from DevOps to Azure. The only thing i need is a user with enough rights to do this. I can even see the service principal in Azure where it tells me that the client secret will expire in two years:
[![Expire of client secret](https://i.stack.imgur.com/RtSr3.png)](https://i.stack.imgur.com/RtSr3.png)

What i dont understand:

1. does the service connection then stop working when the secret expires? Or will DevOps somehow extend the expire date?
2. i cant read this anywhere, so it is up for my own interpretation on how i understand the "service principal" concept, but if the user used to create the principal gets disabled or deleted, then the service principal *will* persist, correct?
3. if 2) is correct, then when will the principal get deleted? When the scope of the principal gets deleted? Or when the service principal itself gets deleted?