> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tenant/administration/applications/enterprise-apps.md).

# Enterprise Applications

Enterprise applications are the service principals present in the selected tenant: every application that has been granted a presence there, including Microsoft first-party services, third-party SaaS apps that users or admins have consented to, and any partner applications such as CIPP's own SAM app. Listing them is the quickest way to audit what has access to a tenant, spot applications carrying client secrets or certificates, and identify leftover integrations from a previous provider.

The table is read live from Microsoft Graph each time the page loads, so it always reflects the tenant's current state.

{% hint style="info" %}
Microsoft first-party service principals make up the bulk of a typical tenant's list, so they are hidden when the page opens and the table shows the same applications as the Enterprise applications view in the Microsoft Entra admin center. Select the **Microsoft apps hidden** chip above the table to include them, and select it again to hide them.
{% endhint %}

## Page Actions

**Deploy Template** opens [Application Approval](/user-documentation/tools/tenant-tools/appapproval.md), where a saved application template can be deployed to one or more tenants.

## Filters

| Filter                    | Shows                                                          |
| ------------------------- | -------------------------------------------------------------- |
| Hidden from MyApps portal | Applications currently hidden from users in the MyApps portal. |

## Sign-in Activity

With a single tenant selected, four columns show whether each application is still in use. They are read from CIPP's cache of the Entra sign-in activity reports, which needs Entra ID P1 and is collected with the nightly cache run, so they can be up to a day behind.

| Column                  | Shows                                                                                                                                                                                                        |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Sign In Activity        | Active (signed in within 30 days), Idle 30+ days, Stale 90+ days, or No sign-in recorded. Measured from when the report was collected. Unknown (not collected) when the tenant's report has not been cached. |
| Last Sign In Date Time  | The application's last sign-in in this tenant, delegated or app-only.                                                                                                                                        |
| Credential Use          | Whether the application's unexpired secrets and certificates have signed in during the last 90 days: All used in 90 days, Unused credentials (with how many of them), or No active credentials.              |
| Last Credential Sign In | The most recent sign-in by any of its secrets or certificates.                                                                                                                                               |

The **Stale (no sign-in for 90+ days)**, **No sign-in recorded** and **Unused credentials (90+ days)** filters use these columns. An unused credential is a good candidate for removal, since nothing has signed in with it. Check with the application's owner first: a credential kept for a rarely run job looks the same.

## Table Details

The properties returned are for the Graph resource type `servicePrincipal`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/serviceprincipal?view=graph-rest-1.0#properties).

The password and certificate credential columns are included so that applications holding secrets or certificates, and their expiry dates, can be reviewed without opening each application in turn.

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>View in CIPP</td><td>Opens the <a data-mention href="/user-documentation/tenant/administration/applications/enterprise-apps/spid.md">View Enterprise Application</a> page for the selected enterprise application.</td><td>false</td></tr><tr><td>View Application</td><td>Opens the selected enterprise application in the Microsoft Entra admin center, in a new tab. Greyed out unless the application is registered in the selected tenant itself.</td><td>false</td></tr><tr><td>Investigate compromise</td><td>Opens <a data-mention href="/user-documentation/tenant/administration/nhi/case.md">NHI Case</a> for the selected application and starts a new compromise investigation of it.</td><td>false</td></tr><tr><td>Create Template from App</td><td>Creates a reusable Enterprise App template from the selected application and copies its permissions into a permission set, both named "&#x3C;application name> (Auto-created)". An option is offered to overwrite an existing template of the same name. Greyed out unless the application is multi-tenant; single-tenant applications need a manifest template created from the App Registrations page instead.</td><td>true</td></tr><tr><td>Remove Password Credentials</td><td>Prompts you to choose which of the application's client secrets to remove, listed by name and expiry date, then removes only those selected. Greyed out unless the application holds password credentials.</td><td>true</td></tr><tr><td>Remove Certificate Credentials</td><td>Prompts you to choose which of the application's certificate credentials to remove, listed by name and expiry date, then removes only those selected. Greyed out unless the application holds certificate credentials.</td><td>true</td></tr><tr><td>Disable Service Principal</td><td>Blocks sign-in to the selected application without removing it or its consent. Greyed out unless the service principal is currently enabled.</td><td>true</td></tr><tr><td>Enable Service Principal</td><td>Restores sign-in for a previously disabled application. Greyed out unless the service principal is currently disabled.</td><td>true</td></tr><tr><td>Hide from MyApps portal</td><td>Removes the application from the MyApps portal so users no longer see it listed there. Greyed out where the application is already hidden.</td><td>true</td></tr><tr><td>Show in MyApps portal</td><td>Restores the application's visibility in the MyApps portal. Greyed out unless the application is currently hidden.</td><td>true</td></tr><tr><td>Manage Owners</td><td>Adds and removes owners of the selected enterprise application. <strong>Add owners</strong> picks from the tenant's users, and <strong>Remove owners</strong> from the current owners. Choose at least one owner to add or remove. Greyed out without the <code>Tenant.Application.ReadWrite</code> permission.</td><td>true</td></tr><tr><td>Manage Assignments</td><td>Assigns users and groups to the selected application, or removes their access. <strong>Assign users</strong> and <strong>Assign groups</strong> pick who to add; group assignment needs Entra ID P1 or P2, only direct members of a group get access, and distribution lists are not offered. <strong>Role for new assignments</strong> is the application role the new users and groups receive, and is required when adding anyone; an application that defines no user roles offers only <strong>Default Access</strong>. <strong>Remove assignments</strong> picks existing user and group assignments to remove. <strong>Assignment required (only assigned users and groups can sign in)</strong> shows the application's current setting and changes it. Greyed out without the <code>Tenant.Application.ReadWrite</code> permission.</td><td>true</td></tr><tr><td>Delete Service Principal</td><td>Removes the application from the tenant, revoking its access and any consent granted to it. The app registration in the application's home tenant is not affected.</td><td>true</td></tr><tr><td>More Info</td><td>Opens the Extended Info flyout with the full details for the selected row.</td><td>false</td></tr></tbody></table>

{% hint style="info" %}
Actions you do not have permission for stay in the menu but are greyed out. Everything except View in CIPP, View Application and More Info needs the `Tenant.Application.ReadWrite` permission.
{% endhint %}

{% hint style="warning" %}
Removing credentials, disabling, or deleting a service principal takes effect immediately and will break any integration currently authenticating as that application. Confirm what an application is used for before acting on it, particularly for applications published by your own or another partner organisation.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cipp.app/user-documentation/tenant/administration/applications/enterprise-apps.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.