Different of Object ID vs Service Principal Object ID?

Question

Different of Object ID vs Service Principal Object ID?

Detail

I registered an app to my resource group.

Home > App registrations, I see the below object id 1 in green.

But when I click on Managed application in local directory : terraform, (in the red box above)

I see object id 2 in red.

So I learned that object id 1 is simply Object ID

and the object id 2 is Service Principal Object ID

But I cannot find anything that really explains the differences clearly.

I found this but it does not explain about Object ID.

Could anyone please help?

Answer 1

Hi,

Object ID is the unique id for the application object, which is template/blueprint for creating the application. The service principal Object ID represents a concrete instance of the application in a tenant.

Let me give an example using something more tangible, a tractor.

Say you have a manufacturer of tractors. They create detailed blueprints, CAD/CAM files, part sourcing details, etc., for a specific model tractor. They assign this group of technical documents a unique ID, which would be the same as our Application Object ID above.

Now, when each tractor is actually made on the assembly line, the manufacturer assigns a unique ID number (VIN) and stamps it on the frame and other places. This unique ID would be the same as Service Principal Object ID above.

Going forward, the VIN serves as a reference for a specific tractor that exists in the real world. Who owns it, service history, etc. Service principal object ID serves as a reference to a specific instance of the application in a specific Azure AD tenant. Who is allowed to use it, what permissions it has been granted to other objects, etc.

Does that make sense?

Please click Accept Answer if the above was useful.

Thanks.

-TP