Service Principals and App Registrations

When applications — whether they run in Azure, on-premises, or in other clouds — need to authenticate to Entra ID and access protected resources, they use app registrations and service principals. Understanding the relationship between these two objects is essential for building secure, integrated applications.

---

App Registration vs Service Principal

These two terms are often confused, but they serve distinct purposes:

App Registration

An app registration is a global definition of an application. It lives in the home tenant where the application was registered and defines:

• The application's identity (client ID, or application ID)
• Authentication settings (redirect URIs, supported account types)
• Credentials (client secrets or certificates)
• API permissions the application requires
• Roles and scopes the application exposes

Think of the app registration as the blueprint of the application.

Service Principal

A service principal is the local representation of an application within a specific tenant. When an app registration is used (or consented to) in a tenant, Entra ID creates a service principal in that tenant.

• In a single-tenant app, there is one service principal in the home tenant
• In a multi-tenant app, there is one service principal in each tenant where the app is used

Think of the service principal as the instance of the application in a particular tenant.

Analogy

Concept	Analogy
App registration	A class definition in object-oriented programming
Service principal	An instance (object) of that class

---

Types of Service Principals

Type	Description
Application	Created from an app registration; represents an application
Managed identity	Created automatically when you enable a managed identity (covered in the previous lesson)
Legacy	Created for on-premises apps registered before the current app model

---

Creating an App Registration

In the Azure Portal

1. Navigate to Microsoft Entra ID > App registrations > New registration
2. Provide a name (e.g., "My API Backend")
3. Choose supported account types:
   • Single tenant — only accounts in your directory
   • Multi-tenant — accounts in any Entra ID directory
   • Multi-tenant + personal — Entra ID accounts and personal Microsoft accounts
4. Set the redirect URI (for web apps, SPAs, or mobile/desktop)
5. Click Register

With Azure CLI

az ad app create --display-name "My API Backend"

This creates the app registration. To create the service principal:

az ad sp create --id <application-id>

---

Authentication: Secrets vs Certificates

Applications authenticate using either client secrets or certificates.

Client Secrets

• A string value generated in the portal or CLI
• Easy to create but less secure (secrets can leak in logs, config files, or source code)
• Have an expiration date (recommended: 6 months or less)

az ad app credential reset --id <application-id> --append

Certificates