App Registrations vs Enterprise Applications in Azure AD - Certificate Significance

Question

Hi,
We're regularly asked to create app registrations and Enterprise Apps in Azure AD. I'm still not clear on the distinction between the 2, other than Enterprise applications are "global" apps create in another tenant and made available across multiple tenants/customers.

My question is why do enterprise applications require a SAML response signing certificate whereas App registrations don't?

Is this a security concern I should be concerned about?

Thanks

Answer 1

Hi @TechUser2020-6505 ,

I recently wrote a blog post about this question.

The App Registration is the actual application object where you configure application settings. The Enterprise Application (or Service Principal object) is a representation (or instantiation) of the application within a directory. It acquires the settings from the application object and is used to grant consent to resources. The Application IDs for both resources are the same because they point to the same application, but the Object IDs are different because they have slightly different purposes.

Apps registered through "App registration" are already configured for OpenID Connect (OIDC) and OAuth by default (instead of SAML). With apps registered through the "Enterprise applications" area of Azure AD the SSO option appears because the implementation of that app for the gallery could include different standards and options to choose (such as SAML, Linked, Disabled, Password). See related thread here.

Let me know if this helps.

Answer 2

Thanks, very helpful answer!