2

Azure Active Directory has applications and service principals.

https://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals

Both objects seem to have credentials. New-AzureADApplicationPasswordCredential New-AzureADServicePrincipalPasswordCredential

If both a service principal and an application object have credential(for example password), which one is used for authentication? If service principal's credential is used, what's the purpose of application object's credential? Is it for fallback when a service princial doesn't have credential?

I read this question, but I cannot understand the difference between application's password and service principal's one. Authentication difference between using AAD app key and Service Principal Password

Wakusei
  • 146
  • 3
  • 12
  • The post above looks clear, where did you not understand? for example? – Joy Wang Oct 25 '19 at 01:23
  • What will happen if both a service principal and an application object have password? Which password is used for authentication? – Wakusei Oct 25 '19 at 09:50

1 Answers1

2

Both of the two passwords can be used to authenticate, but the password of the service principal just can be used to authenticate in the tenant which it located in, the password of the application can be used to authenticate in all the tenants where its service principal instances located.

The service principal is just a instance of the application in a specific tenant, when a tenant consent an application, azure will install it as an Enterprise Application(i.e. serivice principal) in the tenant. There can be several service principals in different tenants, but the application is the only.

Joy Wang
  • 39,905
  • 3
  • 30
  • 54
  • Is the credential of an application the default one in case a service principal of the application has no credential? – Wakusei Oct 25 '19 at 13:47
  • @Wakusei Yse, you need to use `New-AzureADServicePrincipalPasswordCredential` to create it. But you can also use the secret of the application to auth, no matter the service principal in which tenant. – Joy Wang Oct 25 '19 at 14:11