An app registration is a configuration in Microsoft Entra ID that defines an application and its identity. It can specify how the application authenticates and may be used to create credentials, such as a client secret or certificate. The registration is distinct from a service principal, which is the application’s identity instance in a particular tenant and is used when granting access there.
App registrations matter because their credentials and permissions can let software access cloud resources without a person signing in. In an attack, a stolen credential may allow an intruder to authenticate as the application and use the access already granted to its service principal; the registration itself does not determine the scope of damage. Defenders should inventory registrations, minimize permissions, monitor credential and permission changes, and promptly remove or rotate credentials if compromise is suspected.