
Whenever you uh deploying an application in your enter ID environment, you're basically creating two identities, not one but two. Okay. Um the first thing is the application registration which is an identity that have all the all the scope uh defined in it all the blueprint of the application all the redirect URIs in it. uh but it's not the security principle meaning it's it's not it's not the right uh principle that get access to uh all the resources. This is the service principle itself. So the application registration define all the scopes and all the blueprint regarding this the identity but the security identity behind the scene is the service principles.