A public hospital district IT team needs a custom integration that reads hearing-room calendar data through Microsoft identity. Which Entra concept fits?

A public hospital district IT team building a custom integration that reads hearing-room calendar data through Microsoft identity needs an app registration that represents the custom integration's identity in Microsoft Entra ID. The app registration creates the application object, client ID, credentials or certificates, and the basis for Microsoft Graph permission consent so the integration can authenticate as an application or delegated client appropriately.

An Enterprise application entry that represents the consented instance in Microsoft Entra ID is the service principal side of that identity in a tenant where consent and access assignments are recorded, but the instance alone is not the defining identity — the integration still needs the paired app registration's application object, client ID, credentials, and permission-request model to authenticate to Microsoft Graph on its own behalf. A managed identity that supplies the custom integration's identity in Microsoft Entra ID is an automatically managed service principal tied to a specific Azure resource such as a VM, App Service, or Function, not a standalone application identity you register and consent for a custom calendar integration — it cannot be defined with its own client credentials and Graph permission requests the way this hearing-room integration requires. A security group in Microsoft Entra ID that grants the custom integration calendar access can help grant resource access to users or workloads, but a group is not an application identity — it cannot hold client credentials or authenticate to Microsoft Graph the way the integration itself needs to.

Exam caveat: Custom integrations that call Microsoft APIs start with app registration (application identity), then permissions and consent. AB-900 distractors confuse this with deleting workloads, using Teams policies as identity, or abusing Global Administrator.

Operational check: Register the hearing-room calendar integration in Entra, configure a certificate or client secret with rotation, request the least Graph calendar permissions required, grant admin consent under hospital change control, restrict who can manage the app registration, and validate token acquisition before production cutover.