Service principal
In Microsoft Entra ID, a service principal is a security identity representing an application or managed identity within a particular tenant.
One app, a separate identity in each tenant
An application object describes an app in its home tenant. An application-type service principal represents that app in a tenant where it is used. A multitenant app can have service principals in several organizations, each with its own permissions.
Managed identities and legacy applications also use service principals, but without an associated app registration. Managed identity explains how Azure handles credentials for that type.
Which record should you inspect?
In Microsoft Entra, Enterprise applications shows service principals; App registrations shows application objects. When investigating an unfamiliar app, keep both its application ID and local object ID. A display name alone is easy to confuse with another app’s name.
Start with the local grants to understand what the app may do in your tenant. Delegated permissions let it act on behalf of a signed-in user; application permissions let it act without one. Then check resource activity to establish what it actually did. The existence of a service principal does not tell you whether the app read a mailbox or downloaded a file.
Before removing access, check with the application owner which grants are still needed and what will stop working. A legitimate app can have excessive permissions, and an unfamiliar name is not enough to call it malicious.