Why Entra apps matter

Single sign-on

With single sign-on (SSO), one sign-in works across many apps. Users have fewer passwords to remember and reuse, and the organisation has one place to apply sign-in rules and to switch off access when someone leaves.

Security

An app with broad permissions or a forgotten secret is a way into an organisation's data, because attackers can use an app's identity just like a person's. Keeping a clear list of apps, knowing who owns each and watching their sign-ins helps catch problems early.

Least privilege

Least privilege means giving an app only the permissions it needs and nothing more. An app that only reads a user's profile should not hold the ability to read everyone's mail. Reviewing requested permissions before approving them is one of the most effective habits an administrator can have.

Good habits

• Give every app a named owner.
• Prefer certificates or managed identities over long-lived passwords (client secrets) where possible.
• Be careful with application permissions and admin consent.
• Review apps regularly and remove those no longer used.

See how these fit together in the app lifecycle.