/compare/entra-id/app-registration-vs-enterprise-application
App registration vs enterprise application in Microsoft Entra ID (application object vs service principal)
- tool
- Microsoft Entra ID
- compares
- App registration (application object) vs Enterprise application (service principal)
An app registration is the application object: the single, global definition of an app, stored in the tenant where it was registered (its home tenant). An enterprise application is a service principal: the local instance of that app in one tenant, which holds who may use it, which permissions were consented and the sign-in logs. Registering an app in the Entra admin center creates both in your tenant; every other tenant that consents to a multitenant app gets only a service principal.
| Criterion | App registration | Enterprise application |
|---|---|---|
| Object type | Application object (Graph: application) | Service principal (Graph: servicePrincipal) |
| How many | One per app, in its home tenant | One per tenant where the app is used |
| Admin center page | App registrations | Enterprise applications |
| You configure | Client ID, secrets and certificates, redirect URIs, requested API permissions, app roles, exposed scopes, branding | User and group assignment, "Assignment required?", granted consent, single sign-on, provisioning, Conditional Access targeting |
| Permissions | Requested permissions (the list on API permissions) | Granted permissions after consent |
| Graph PowerShell | Get-MgApplication, New-MgApplication | Get-MgServicePrincipal, New-MgServicePrincipal |
| Deleting it | Also deletes the service principal in the home tenant | Removes the app from that tenant only; the registration stays |
Find one from the other
The Application (client) ID (appId) is the same on both objects; the Object ID is different. Admin tools and errors usually mean the appId:
Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -Filter "appId eq '00000000-0000-0000-0000-000000000000'" # only in the home tenant
Get-MgServicePrincipal -Filter "appId eq '00000000-0000-0000-0000-000000000000'" # in any tenant that uses itIn the admin center, the app registration's overview links to Managed application in local directory, which is the enterprise application.
Which one to change
- Adding a certificate for
Connect-ExchangeOnline -CertificateThumbprintorConnect-MgGraphapp-only sign-in: app registration (Certificates & secrets). - Adding an API permission: request it on the app registration, then grant admin consent (the consent is recorded on the service principal).
- Allowing only some users to sign in to an app: enterprise application (Properties > Assignment required, then Users and groups).
- Assigning an Entra role to an app, for example Exchange Administrator for app-only Exchange scripts: the role is assigned to the service principal.
Three kinds of service principal
Microsoft distinguishes application service principals (created from an app registration), managed identity service principals (for Azure resources, no app registration you manage) and legacy service principals (apps created before app registrations existed, usable only in their own tenant). Managed identities appear under Enterprise applications but not under App registrations.