When you register an application with Microsoft Entra ID, two objects are involved. The application object, seen under App registrations, is the global definition of the app: its name, application (client) ID, redirect URIs, credentials (client secrets or certificates), the permissions it asks for and any app roles or scopes it exposes. It lives in the app's home tenant. The service principal, seen under Enterprise applications, is the local instance of that app in a specific tenant. It is what actually gets signed in, assigned users, granted consent and targeted by Conditional Access. One application object can have service principals in many tenants (a multitenant app), each with its own consent and assignments.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.