An application registration is the directory record that creates an app identity inside a tenant. It defines how the app authenticates, what redirect or callback URLs it uses, and what permissions or sign-in workflows it can participate in. In platforms like Entra ID, the registration is the starting point for a tenant-integrated app; a matching service principal is then created in the tenant to represent that app at runtime.
In cyber security, this matters because the registration becomes a trust anchor. Attackers who can create or alter it may be able to impersonate a legitimate service, redirect authentication traffic, or place an external identity provider into a sign-in flow. Defenders should tightly control who can register apps, review new registrations and consent grants, and monitor for unexpected credentials, redirect URIs, or policy changes. In practice, application registrations are common in SSO, OAuth integrations, API access, and external MFA services, so they should be treated as sensitive identity infrastructure, not routine admin clutter.