You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant. From the Azure portal, you register an enterprise application. Which additional resource will be created…

Question

Options

• Aa service principal
• Ban X.509 certificate
• Ca managed identity
• Da user account

• A
  91% (20)
• C
  5% (1)
• D
  5% (1)

Explanation

When you register an enterprise application in Azure AD, a service principal is automatically created in the tenant alongside the application registration. The service principal acts as the application's identity within that specific Azure AD tenant, enabling it to authenticate and be granted permissions to resources - think of the app registration as the "blueprint" and the service principal as the "instance" running in your tenant.

Why the distractors are wrong:

• B (X.509 certificate): Certificates can optionally be uploaded as credentials for an app, but none is automatically generated upon registration.
• C (Managed identity): Managed identities are a separate feature assigned to Azure resources (like VMs or App Services) to avoid credential management - they are not created by registering an enterprise application.
• D (User account): User accounts represent human identities; registering an application creates a non-human service identity, not a user account.

Memory tip: Use the analogy "App Registration = Passport, Service Principal = Visa." The passport (app registration) defines who you are globally, while the visa (service principal) is what gets stamped in each specific country (tenant) to grant access. Every time you register an app, Azure automatically stamps that visa.

No community discussion yet for this question.