Azure AD Application vs Service Principal Concept Distinction

Question

I still have difficulty to grasp the dissimilarities between Managed Applications and their Service Principal.

From what I understand, App Registrations encapsulate the App ID, Credentials/Certificates, Scope, and that Service Principals encapsulate management of consent, scopes and other instances must be created when using the application in other tenants whilst they all point to the original App Registration and where it was created. I also understand that the Service Principal is another type of identity and it's this identity that the app uses to authenticate to Azure AD via OAuth2 and determine the app users authorizations and fetches info using OpenID.

Where I'm having difficulty putting together these concepts is when it's specified that the Service Principal is the "Local Representation of the app in the Local Directory". I understand this makes sense when the app is used in another tenant since another Service Principal is created in that other directory, but I don't understand where this makes sense when this is a single tenant app. Like, It's weird for me to say something like "it's the local representation of the application that is also local to the same directory"?

Answer 1

Hi,

You can think of Application object as a globally unique template/blueprint/definition that represents an application whereas the Application service principal object is a concrete representation of the application for purposes of consent being given to it, permissions to access resources being granted to it, etc., in a specific tenant. It's a one-to-many relationship in that there is only 1 Application object (which exists in only one tenant), but there can be many Application service principals (one for each tenant).

An application object could exist without any linked application service principals. It's really only when the application needs to be used (given consent, granted access, etc.) in a specific tenant that a corresponding application service principal instance needs to exist in that tenant.

-TP

Answer 2

Hello @Pier-Carl Venne

Thank you for sharing this question on this community space.

I would like to gather the following article as well as the URL for the same. So, I am pasting a small segment of it down below:

https://www.techtarget.com/searchcloudcomputing/tip/Why-and-how-to-create-Azure-service-principals#:~:text=The%20key%20difference%20between%20Azure,a%20role%20to%20the%20identity.

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 3

actually i am stil bit confuse about the difference; so if there is no multi-tenant then actually no key difference right?