Definitions EntraIdApps

Understanding Entra ID App Types

When granting permissions to an application in Microsoft Entra ID, you will encounter two distinct API models. Choosing the correct one depends on who — or what — needs to authenticate. In NovaPoint, this is the choice you make when adding an app on the Settings page: a Delegated app or an App-Only app.

This article explains the difference. For the step-by-step registration, jump to How to set each one up.

The Two App Types

1. Delegated Permissions (Delegated app)

The app acts on behalf of a signed-in user.

How it works:

• A user must interactively sign in.
• The app inherits exactly what that user is allowed to do.
• If the user cannot access a resource, the app cannot either.

When to choose this:

• Your app needs to access only the resources the user already has access to.
• You want individual user identities to appear in audit logs.

2. Application Permissions (App-Only)

The app acts with its own identity, independent of any user.

How it works:

• No user signs in.
• The app uses its own client credential (certificate).
• Permissions are granted directly to the app via admin consent.

When to choose this:

• You need to access tenant-wide data regardless of which user is present.
• The operation shouldn't be linked to a single user account.
• You want it to run unattended (for example, on a schedule).

Note

In NovaPoint, an App-Only app ignores options that depend on the signed-in user — such as adding or removing your account as Site Collection Admin — because it already acts with tenant-wide application permissions.

Configuration Summary

	Delegated	App-Only
A user signs in	Yes	No
Needs a certificate	No	Yes
Runs unattended	No	Yes
Actions attributed to a user	Yes	No
Admin consent required	For sensitive scopes*	Always

*The permissions NovaPoint uses require admin consent in both cases.

How to set each one up

• Register a Delegated App
• Register an App-Only App