Service principal is missing in client tenants

Question

I have an iOS app integrated with Intune SDK. It is using the commercial multi-tenant Entra appid for the MSAL configuration. As part of Intune SDK update to 21.1.0, we had to use the AppId and redirect URL in the code base (As per this announcement- #569)

Prior to this update in December, our Intune-integrated app was working for all customers. However, after the update, customers began reporting login failures. We recommended them to give consent to our app using tenant-wide admin consent URL. But they were getting a blank screen on using this url. During our investigation, we discovered that the Service Principal for our app was missing in their Entra environments.

What could be the reason for this?

As a workaround, we advised customers to manually create the Service Principal using Microsoft Graph PowerShell or Azure CLI. This resolved the issue for them. But some of them raised concern about manually creating it.

Are we missing anything in out Entra app registration that could block the creation of service principal for the client tenants?

Answer 1

The behavior is explained by how Microsoft Entra application objects and service principals work, and by what happens when a tenant doesn’t yet “know” about a multitenant app.

1. Why service principals are missing in customer tenants

• An app registration creates:
  • One application object (global definition) in the home tenant.
  • One service principal in the home tenant only.
• For a multitenant app, a separate service principal must be created in each customer tenant where the app is used. This happens when a user or admin in that tenant consents to the app.
• If the service principal doesn’t exist yet in a tenant, Microsoft Entra can’t fully establish the app’s identity there. This is the same root cause described for the error “The identity of the calling application could not be established”: the service principal doesn’t exist in the tenant or the tenant isn’t aware of the application.
• The Intune SDK change that requires explicit ADALClientId and redirect URI means the app is now consistently using a specific Entra app registration. If some tenants never completed consent for that app (or previously used a different app ID/authority), they will now hit the missing–service-principal condition.
• When a tenant-wide admin consent URL is used but the tenant has no service principal and something in the flow fails (for example, consent UX or configuration), the result can be a blank screen and no service principal is created. The underlying issue is still that the tenant has no local service principal for the app.

2. Why manual creation of the service principal fixes it

• A service principal is the local representation of the app in that tenant. Once it exists, Entra can issue tokens with the correct oid/sub claims and the app’s identity can be established.
• Creating the service principal via Microsoft Graph PowerShell or Azure CLI is equivalent to what would happen automatically when consent succeeds. That’s why this workaround resolves the login failures.

3. What to check in the app registration

From the Entra perspective, the key requirements are:

• The app must be configured as multitenant if it is intended for multiple customer tenants.
• The app must have a valid redirect URI that matches what the Intune SDK/MSAL is using (ADALRedirectUri or ADALRedirectScheme in IntuneMAMSettings).
• The client ID used by the Intune SDK (ADALClientId) must be the same as the Entra app registration’s appId.

Within the constraints of the provided context, there is no additional app-registration flag that “forces” service principal creation in other tenants. The service principal is created when the tenant successfully consents to the app. If consent fails or is never completed, the service principal remains missing.

4. Recommended pattern instead of manual SP creation

• The supported pattern is to:
  • Ensure the app is correctly configured as multitenant with correct redirect URIs.
  • Use an admin consent URL constructed as documented to add the enterprise application and grant permissions in each customer tenant.
• This is the same mechanism described for fixing cases where the service principal is missing and Entra returns errors like:
  • “The client application {appId} is missing a service principal in the tenant {tenantId}.”
  • “The identity of the calling application could not be established.”

If customers are seeing a blank screen on the admin consent URL, the next step is to validate that the URL is constructed exactly as documented (correct {organization} and {client-id}) and that the admin is signing in with an account from the target tenant. Once consent completes successfully, the service principal will be created automatically and manual creation will no longer be necessary.

---

References:

• Create an enterprise application from a multitenant application (admin-consent-url)
• Application and service principal objects in Microsoft Entra ID
• Error "The identity of the calling application could not be established"
• Stage 3: Intune SDK Integration Into Your iOS App