Azure Enterprise App Registration Creates Service Principal

SC-500 By islever Editorial Last updated

Secure access to resources by using Microsoft Entra ID

Short answer

C Registering an enterprise application in Microsoft Entra ID automatically creates a service principal to represent the app's identity.

Question

You have an Azure subscription that is linked to a Microsoft Entra tenant.
From the Azure portal, you register an enterprise application.
Which additional resource will be created in Microsoft Entra ID?
  1. a managed identity
  2. a user account
  3. a service principal Correct Answer
  4. an X.509 certificate

Key Takeaways

Distinguish between the 'App Registration' (the definition of permissions/credentials) and the 'Service Principal' (the instance of that app in the directory used for authentication).

Registering an enterprise application in Microsoft Entra ID automatically provisions a service principal. This resource allows the application to authenticate and access secured resources.

Common mistake: Selecting X.509 certificate because apps often use certificates for auth, but these are optional attachments, not automatic creations during registration.

Expert Analysis

When you register an enterprise application (app registration) in Microsoft Entra ID, the system automatically creates a service principal instance. This service principal represents the actual identity of the application within a specific tenant and is required for the app to authenticate and access resources.

Official Reference

https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the lifecycle of Microsoft Entra ID objects: App Registration defines the app, while the Service Principal is its operational identity in the tenant. For SC-500, recognize that 'registering an app' implies the immediate existence of a service principal for access control decisions.

Frequently Asked Questions

What is the difference between an App Registration and a Service Principal?

An App Registration is the definition of the application (including its metadata and permissions), while a Service Principal is the instance of that application within a specific tenant, used for authentication and authorization.

Do I need to manually create a service principal?

No, the service principal is automatically created when you register the application in the tenant. You only manage it if you need to configure specific access policies or secrets.

More SC-500 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. joeytrib 👍 1 Answered C
    When you register a new application in Microsoft Entra ID, a service principal is automatically created for the app registration. https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Is Get Agent Unavailable for an Intune Security Copilot Agent?

S-grade

How Should App1 Access Azure Files Without Storage Account Keys?

S-grade

Can VM Security Group Membership Grant Storage Access?

S-grade

Can Agent ID Developer PIM Settings Be Shortened to Two Days?

S-grade

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide