A unique identifier of a service instance in Kerberos/AD, e.g. MSSQLSvc/db01.corp.local:1433. An SPN is bound to the account the service runs as and lets clients request a ticket for exactly that service.
When an SPN is registered on a regular user account, that account becomes a target for Kerberoasting.