Difference between Azure App Registration vs Service Principal
An App Registration is the application’s definition.
A Service Principal is the application’s identity inside a tenant.
Think of it like this:
App Registration = blueprint
Service Principal = actual instance created from that blueprint
Microsoft describes the application object as the app definition, while the service principal is the local representation of that app in a specific tenant. (Microsoft Learn)
What is an App Registration?
An App Registration is created when you register an application in Microsoft Entra ID.
It contains the app’s core configuration, such as:
Application/client ID
Redirect URIs
Client secrets or certificates
Supported account types
API permissions the app requests
App roles
Authentication settings
Use App registrations when you want to configure how the app authenticates or what permissions it requests. Microsoft Entra app registrations are managed under Entra ID > App registrations. (Microsoft Learn)
What is a Service Principal?
A Service Principal is the app’s actual security identity in a tenant.
It controls what the app can do in that tenant, such as:
What permissions were actually granted
Whether users can access the app
Whether the app is enabled
Sign-in activity
Azure RBAC role assignments
Tenant-specific access controls
In the Entra admin center, service principals are shown under Enterprise applications. (Microsoft Learn)
Key difference
| App Registration | Service Principal |
|---|---|
| Defines the application | Represents the app in a tenant |
| Found under App registrations | Found under Enterprise applications |
| Used to configure app settings | Used to manage access and permissions |
| Contains requested permissions | Contains granted permissions |
| Used by developers/app owners | Used by admins/security/IAM teams |
Simple example
A developer creates an app registration called:
Finance Reporting App
That app registration defines the app’s login settings, secrets, certificates, and requested API permissions.
When the app is used in a tenant, Entra creates a service principal for it. That service principal is what receives actual access, consented permissions, sign-in logs, and Azure role assignments.
So:
App Registration = what the app is
Service Principal = what the app can access
Single-tenant vs multitenant
For a single-tenant app, the app usually has one app registration and one service principal in the same tenant.
For a multitenant app, there is one app registration in the app owner’s tenant, but a separate service principal is created in every tenant where the app is used. (Microsoft Learn)
Example:
Vendor tenant:
App Registration
Customer tenant A:
Service Principal
Customer tenant B:
Service Principal
Customer tenant C:
Service Principal
This is why third-party SaaS apps often appear in your tenant under Enterprise applications, even though you do not own their app registration.
Which one should you use?
Use App registrations when you need to:
Add or rotate a secret/certificate
Change redirect URIs
Configure authentication
Add requested API permissions
Expose an API
Manage app roles
Use Enterprise applications / Service Principals when you need to:
Review granted permissions
Check sign-in activity
Disable an app
Assign users or groups
Review admin consent
Assign Azure RBAC access
Investigate third-party app access
Summary:
The simplest rule is:
App Registration = configuration of the app
Service Principal = identity and access of the app in a tenant
For developers, most setup work happens in App registrations.
For security, IAM, and operations teams, most access review happens in Enterprise applications.
