A city clerk explains how a custom municipal app should appear as an identity object before it requests Graph permissions. Which object fits?

When a city clerk explains how a custom municipal app should appear as an identity object before it requests Graph permissions, the correct object is an app registration that establishes the custom app’s identity in Microsoft Entra ID. App registration is the prerequisite identity record for client IDs, redirect URIs, secrets/certificates, and later API permission requests against Microsoft Graph or other APIs. An enterprise application that registers the custom app's identity in Microsoft Entra ID gets the role backward; it is the tenant-side instance for use, consent and access, not the app registration that actually registers the custom app's identity. A managed identity that gives the custom app's Azure host its Microsoft Entra identity is an Azure resource identity, not the app-registration model that a custom municipal app uses to request Graph permissions. A service principal that provisions the custom app's identity in Microsoft Entra ID reverses the relationship; it is the tenant-local instance created from the app registration, not the registration that provisions the identity and requests Graph permissions. Exam caveat: AB-900 distinguishes app registration (app identity) from enterprise applications, service principals, and managed identities for the custom app's Azure host. Operational check: Create the app registration for the municipal custom app, record the client ID, add owners from the clerk’s IT partners, configure credentials securely, then add Graph permissions and follow the city’s consent process—never substituting an enterprise application, a service principal, or a managed identity for the custom app's Azure host for the app identity.