An application identity is the identity software uses to authenticate and request access to cloud resources. In Microsoft Entra, an application’s tenant-specific representation is commonly a service principal. Administrators can assign permissions or approve consent grants to let it access services such as email, files, or backups.
These identities enable integrations to work without a person signing in, but permissions that are too broad can make them valuable targets. Attackers who compromise an application or its credentials may use its granted access, sometimes without taking over a user account. Defenders should inventory application identities, limit permissions to what is necessary, review consent and assignments, and monitor sign-in and audit logs. Disabling an application identity may not by itself revoke tenant-side grants or immediately invalidate existing access tokens.