Why might an application be mapped to an identity entity?

Mapping to an identity entity does not prohibit administrators from revoking tokens; administrators with sufficient privileges can revoke any token.

Identity entities are a security and management feature within Vault, not a mechanism to bypass cloud licensing limitations.

Mapping an application (or user) to an identity entity provides a canonical identity within Vault, enabling consistent policy enforcement regardless of the authentication method used by the application (e.g., AWS IAM, Kubernetes, LDAP). This ensures that all tokens issued to that entity, through different auth methods, inherit the same set of policies associated with the entity.

Identity entities provide a consistent identity within Vault, which helps with policy enforcement and token management, but it doesn't directly describe enabling an application in one cloud to access tokens provisioned for another instance of the same application.