Enterprise Applications
Enterprise applications are the service principals present in the selected tenant: every application that has been granted a presence there, including Microsoft first-party services, third-party SaaS apps that users or admins have consented to, and any partner applications such as CIPP's own SAM app. Listing them is the quickest way to audit what has access to a tenant, spot applications carrying client secrets or certificates, and identify leftover integrations from a previous provider.
The table is read live from Microsoft Graph each time the page loads, so it always reflects the tenant's current state.
Microsoft first-party service principals make up the bulk of a typical tenant's list. Sort or filter on Publisher Name to bring third-party and partner applications to the top.
Page Actions
Deploy Template opens Application Approval, where a saved application template can be deployed to one or more tenants.
Table Details
The properties returned are for the Graph resource type servicePrincipal. For more information on the properties please see the Graph documentation.
The password and certificate credential columns are included so that applications holding secrets or certificates, and their expiry dates, can be reviewed without opening each application in turn.
Table Actions
View in CIPP
Opens the View Enterprise Application page for the selected enterprise application.
View Application
Opens the selected enterprise application in the Microsoft Entra admin center, in a new tab.
Create Template from App
Creates a reusable Enterprise App template from the selected application and copies its permissions into a permission set, both named "<application name> (Auto-created)". An option is offered to overwrite an existing template of the same name. Only available for multi-tenant applications; single-tenant applications need a manifest template created from the App Registrations page instead.
Remove Password Credentials
Prompts you to choose which of the application's client secrets to remove, listed by name and expiry date, then removes only those selected. Only available where the application holds password credentials.
Remove Certificate Credentials
Prompts you to choose which of the application's certificate credentials to remove, listed by name and expiry date, then removes only those selected. Only available where the application holds certificate credentials.
Disable Service Principal
Blocks sign-in to the selected application without removing it or its consent. Only available where the service principal is currently enabled.
Enable Service Principal
Restores sign-in for a previously disabled application. Only available where the service principal is currently disabled.
Delete Service Principal
Removes the application from the tenant, revoking its access and any consent granted to it. The app registration in the application's home tenant is not affected.
More Info
Opens the Extended Info flyout with the full details for the selected row.
Removing credentials, disabling, or deleting a service principal takes effect immediately and will break any integration currently authenticating as that application. Confirm what an application is used for before acting on it, particularly for applications published by your own or another partner organisation.
Feature Requests/Ideas
We value your feedback and ideas. Please raise any feature requests on GitHub.
Last updated
Was this helpful?