How Do You Find Risky App Registrations and Service Principals in Entra ID?

Risky app registrations and service principals usually show up as apps holding more permission than they use, apps with no owner, and apps nobody has signed in with for a long time. The Microsoft Entra admin center lists them under App registrations and Enterprise applications, and a validation platform can track them against an approved baseline over time.

Start with the difference between the two objects, because each one tells you something different about the same app.

What is the difference between an app registration and a service principal?

Microsoft describes the application object as the global representation of an app and the service principal as its local representation in a specific tenant. One app registration can have many service principals: a multitenant app gets one in each tenant where someone consented to it.

Attribute	App registration (application object)	Service principal
What it is	The app’s definition and blueprint	The app’s instance in one tenant
Where it lives	Only in the app’s home tenant	In every tenant where the app is used
What it controls	Settings such as credentials and the permissions the app requests	What the app can do in that tenant, who can use it, and what it can reach
Where to find it	Entra admin center, App registrations	Entra admin center, Enterprise applications

Two other kinds of service principal appear in the same list. Managed identities let Azure resources authenticate without anyone handling credentials, and legacy service principals represent apps created before app registrations existed. Neither has an app registration behind it, so a review that only looks at App registrations will miss them.

Why do app identities become risky?

An app identity authenticates with a secret or a certificate instead of a person completing MFA. When its permissions are broad, whoever holds that credential holds that access.

Microsoft calls tenant-wide admin consent a sensitive operation, because it can give an app’s publisher access to significant portions of an organization’s data. Most risky apps were approved for a real need, and the access stayed after the need ended.

What are the signs an app registration or service principal needs attention?

How do you review app registrations and service principals in Entra ID?

A first review can happen in the Microsoft Entra admin center with access you already have. Record what you find as you go, so the next review starts from a known state.

• List every service principal. Start in Enterprise applications and widen the application type filter so managed identities appear alongside your own apps.
• Review granted permissions. Open each high-access app and check its Permissions page for admin consent and user consent grants.
• Check user consent settings. Decide whether users can consent at all, and whether to limit consent to verified publishers and low-impact permissions.
• Confirm owners. Every app registration should have a current owner who can explain why it exists.
• Look at sign-in activity. Service principal sign-ins appear in the Entra sign-in logs. Apps with no activity are candidates for removal once the owner confirms.
• Check credential expiry. Review the secrets and certificates on each app registration and note which ones nobody is rotating.

Before removing an app, note that deleting an application object also deletes its home tenant service principal, and restoring the app registration later does not bring that service principal back.

What tools find risky app registrations and service principals in Entra ID?

Microsoft provides the core views: App registrations, Enterprise applications, consent settings and the sign-in logs. They show the current state of each app, and they are where any fix gets made.

What teams usually add is a record over time. A single review shows which apps are risky today, while auditors and leadership often ask whether permissions changed since the last review and who approved them. When you compare tools, ask whether they:

• Cover every identity type. App registrations, enterprise apps, managed identities and legacy service principals.
• Show consent and permission detail. Which permissions were granted, by whom, and at what scope.
• Track changes between reviews. A new permission or credential on a sensitive app should surface before the next audit.
• Connect findings to other settings. An overprivileged app matters more when it sits next to a Conditional Access gap or a privileged role.
• Produce evidence. Findings with history and ownership that an auditor can review.

The Accelerynt Security Platform validates App Registrations for consent grants, risky permissions and abandoned app identities, and its Non-Human Identities checks cover authenticating agents and API connections. It works with read-only permissions, and remediation stays with your team, supported by documented guidance for each finding.

App permissions rarely sit on their own. For how sign-in policies combine, read which Conditional Access policy takes precedence in Entra ID. For the wider practice of keeping a tenant in its approved state, see how to manage Microsoft 365 security and prove it works and what continuous control validation means for Microsoft security.

Where to go next

For hands-on help, our Microsoft security engineering team configures and secures Entra ID. To see where your tenant stands today, start with a Microsoft Control Validation Assessment. Identity risk also runs through people and process, which we cover in The Help Desk Is Now a CISO-Level Liability. For how to test and protect the reset process, read how to protect the help desk from social engineering.

Frequently asked questions