App registration
In Microsoft Entra ID, app registration creates an identity configuration that lets an application integrate with the directory's identity services.
Where an application’s identity is configured
Registration creates an application object in its home tenant and assigns an application, or client, ID. The configuration can include supported account types, redirect URIs, credentials, and requested API permissions.
The application object defines the app. A service principal represents the app in a particular tenant. For a multitenant app, the publisher may own the registration while your organization has its own local service principal.
Registration does not grant access
A permission listed in the registration is a request, not proof that someone approved it. Check the grant to see what was approved, then resource activity to see what the app used.
When investigating an app, record both the application ID and the local service principal’s object ID. The first identifies the app; the second identifies its representation in the tenant you are examining. A supplier’s registration and your tenant’s Enterprise applications entry can refer to the same app while showing different parts of its configuration.
Keep registration changes and consent changes separate in the review. A changed redirect URI or credential affects how the app operates; a permission grant affects what it can access. Both need an explanation from the app owner, but they are not the same change.