A municipal-records team registered an API under App registrations, but a contractor searched only Enterprise applications and reported that the app does not exist. How should the security engineer explain the relationship in this tenant?
Select an answer to reveal the explanation.
Short Explanation
App registration is the blueprint; the enterprise app is the badge that blueprint wears inside your tenant. Register the API and Entra also stamps out a service principal—search both blades before declaring it missing.
Full Explanation
In Microsoft Entra ID, an app registration creates an application object. A corresponding enterprise application (service principal) represents that app’s instance in a tenant for sign-in, grants, and policies. When the municipal-records team registered an API under App registrations but a contractor searched only Enterprise applications and said the app does not exist, explain that the registration is the application object and the enterprise application is the service principal—ensure the service principal exists/visible in this tenant rather than concluding the API was never registered.
Claiming enterprise applications are only for gallery SaaS so first-party APIs never create a service principal is false. Claiming app registrations live only in Key Vault is nonsense and unrelated. Telling the contractor to look for MSAL samples in source control fails as an identity-directory explanation of where objects live in Entra.
Exam caveat: multi-tenant scenarios add home-tenant application objects versus customer-tenant service principals—know which blade you are searching. Operational check: open the app registration, confirm a service principal/enterprise application exists in the tenant (create if missing via supported means), show the contractor both blades, and document the naming so future searches succeed.