naming mismatch in azure entra id

Hi Richee Pitchee,

This visual and naming distinction in Microsoft Entra ID stems from the core architecture of how identity objects are managed. The item labeled Application with the blue cube icon represents an App Registration, which is the global template and definition of your application configuration. The item labeled Service Principal with the green earth icon represents an Enterprise Application, which is the actual local instance of that application created within your specific tenant to manage access, single sign-on, and user assignments.

This architecture explains why you land on different management blades when clicking each search result. When you need to manage permissions, user assignments, or access controls, you should always select the Service Principal or green earth icon, as this opens the Enterprise Application blade containing the Users and groups menu you are looking for. The App Registration blade opened by the blue cube icon is primarily used by developers to configure application properties like redirect URIs, certificates, and API permissions, which is why it does not explicitly display an enterprise service type banner.

I hope the response provided some helpful insight. If it clarified the issue for you, please consider marking it as Accept Answer so others with the same issue can find the solution. Feel free to leave a comment if you need further information.

Tracy Le.

Hi Richee Pitchee,

To clarify why these separate objects exist, the item labeled Application with the blue cube icon strictly represents an Application Registration template within your directory. It does not represent other distinct object types in this search context because its sole architectural purpose is to serve as the global blueprint for an identity, defining core attributes like the application ID, multi-tenant status, and requested API permissions.

In contrast, the item labeled Service Principal with the green earth icon can represent several different functional instances beyond standard third-party Enterprise Applications. For example, it represents Managed Identities used by Azure resources like virtual machines or function apps to authenticate securely without storing credentials in code.

It also represents core Microsoft first-party services like Microsoft Graph, as well as multi-tenant applications registered in external organizations that your local users have consented to use. In all these cases, the green icon indicates that an active security principal is executing permissions in your local tenant, which is why the operational configurations like user assignments always reside there.