What are the differences between Service Principal and App Registration?

Allan Xu

28 Jun 2024, 02:19 UTC

40K views1

I understand that App Registration represents an app that might have UI for users to login. I understand that a Service Principal is for applications like scheduled batch processing applications.

But from the technical perspective, in Azure Portal App Registration list, I can see both of them in the list and look the same.

Is there anything that an SP can do that an App Registration cannot or vice versa?

azure-active-directory

2,207 following

1 answer

Accepted answer · original discussion

AlfredoRevilla-MSFT

01 Jul 2024, 02:19 UTC

Permalink

The App registration is the template used to create the SP. The SP is a security principal (like a User) which can be authenticated and authorized. Follow juunas link, specially Relationship between application objects and service principals.

2 question comments

Use comments to ask for clarification. Post a solution as an answer.

juunasPermalink

29 Jun 2024, 14:19 UTC

Did you check this documentation? learn.microsoft.com/en-us/azure/active-directory/develop/…

Max IvanovPermalink

02 Jul 2024, 14:19 UTC

You may want to check this SO question too: stackoverflow.com/questions/54066287/…

Keep exploring this topic

Azure Active Directory - Universal with MFA "missing" from SSMS authentication options

I am trying to connect to from SSMS/VS 2022 to a database hosted on Azure. When trying to login via either application, the authentication option "Azure Active Directory - Universal with MFA" is not available, in fact, no Azure Active Directory options are available at all. The options I have are below... enter image description here I ha

Azure AD B2C vs Azure Active Directory External Identities vs Microsoft Entra External ID

We need an auth service like Auth0 or Clerk . So Customer Identity and Access Management (CIAM) We're building all our services in Azure so we'd like to user their authentication service for the closest integration with Web Apps, APIs and Front Door. However the Azure product naming seems incredibly complicated. Reading this article title

Keycloak: Map email from Azure AD to auto created Keycloak Users

I have added the Microsoft Active Directory as an identity provider as shown below and configured the Authentication flow to automatically create the user(s) Mapper is configured to Map the user to a Role based on the claims Everything works till this part, Users are getting created/added automatically However, Email column is empty. I wa

"Storage account connection string 'AzureWebJobsStorage' does not exist." when starting Azure Function with Queue Trigger and AAD Identity

We have an Azure Function with Queue Trigger that was working just fine until some weeks ago, when the infrastructure guys switched to AAD Identity. Ever since, we have been getting the following exception whenever the Function starts: Error indexing method 'MyFunctionName' Storage account connection string 'AzureWebJobsStorage' does not

What are the differences between Service Principal and App Registration?

1 answer

2 question comments

Your perspective belongs here.

Good answers start here.