4.2. Enterprise Applications
💡 First Principle: Every app your tenant uses is represented by a service principal — the local instance through which you assign users, configure SSO, and grant permissions. Manage the instances well and one identity opens every SaaS door with policy attached; manage them poorly and each app is its own island of accounts and stale access.
Why this section earns its exam weight: SSO is the visible payoff (one credential, CA everywhere, one off-switch at termination), but the governance surface is where organizations bleed — who may consent to what, which apps demand assignment, who administers the portfolio. Keep Phase 1's blueprint/instance model in hand: the application object (registration, 4.3) is the blueprint in its home tenant; the enterprise application (service principal) is the instance in your tenant.
⚠️ Common Misconception: App registration and enterprise application are two names for one thing. Creating a registration auto-creates a matching service principal, so they look unified — but gallery apps arrive as only a service principal (Microsoft or the vendor owns the blueprint), and per-tenant state (assignments, SSO config, consent grants) always lives on the service principal. Knowing which blade to open is half of several exam answers.
