<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>App Registration on Andrew Wilson's Blog</title><link>https://andrewilson.co.uk/tags/app-registration/</link><description>Recent content in App Registration on Andrew Wilson's Blog</description><generator>Hugo -- gohugo.io</generator><language>en</language><lastBuildDate>Fri, 01 May 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://andrewilson.co.uk/tags/app-registration/index.xml" rel="self" type="application/rss+xml"/><item><title>Azure App Registrations | Display Name Guidance</title><link>https://andrewilson.co.uk/post/2026/05/azure-application-registrations-same-displayname/</link><pubDate>Fri, 01 May 2026 00:00:00 +0000</pubDate><guid>https://andrewilson.co.uk/post/2026/05/azure-application-registrations-same-displayname/</guid><description>&lt;h2 id="problem-space"&gt;Problem Space&lt;/h2&gt;
&lt;p&gt;I recently had to troubleshoot an issue where two App Registrations in the same tenant had the same display name.&lt;/p&gt;
&lt;p&gt;Azure allows this. Operationally, it hurts.&lt;/p&gt;
&lt;p&gt;When names are duplicated, diagnosis gets slower and riskier because engineers cannot trust what they see first in the portal.&lt;/p&gt;
&lt;h2 id="why-it-matters"&gt;Why It Matters&lt;/h2&gt;
&lt;p&gt;Display names are not unique identifiers. They are labels.&lt;/p&gt;
&lt;p&gt;That creates avoidable failure modes:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Wrong app selected during incident response&lt;/li&gt;
&lt;li&gt;Secrets/certificates updated on the wrong registration&lt;/li&gt;
&lt;li&gt;Permission checks performed against the wrong object&lt;/li&gt;
&lt;li&gt;Longer time to restore service because every step needs extra ID validation&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id="what-is-actually-unique"&gt;What Is Actually Unique&lt;/h2&gt;
&lt;ul&gt;
&lt;li&gt;Display name: not unique&lt;/li&gt;
&lt;li&gt;Application (client) ID: unique&lt;/li&gt;
&lt;li&gt;Object ID: unique&lt;/li&gt;
&lt;li&gt;Service principal object ID: unique per tenant instance&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Humans start with names; Azure enforces uniqueness with IDs. Good naming closes that gap.&lt;/p&gt;</description><content:encoded><![CDATA[<h2 id="problem-space">Problem Space</h2>
<p>I recently had to troubleshoot an issue where two App Registrations in the same tenant had the same display name.</p>
<p>Azure allows this. Operationally, it hurts.</p>
<p>When names are duplicated, diagnosis gets slower and riskier because engineers cannot trust what they see first in the portal.</p>
<h2 id="why-it-matters">Why It Matters</h2>
<p>Display names are not unique identifiers. They are labels.</p>
<p>That creates avoidable failure modes:</p>
<ul>
<li>Wrong app selected during incident response</li>
<li>Secrets/certificates updated on the wrong registration</li>
<li>Permission checks performed against the wrong object</li>
<li>Longer time to restore service because every step needs extra ID validation</li>
</ul>
<h2 id="what-is-actually-unique">What Is Actually Unique</h2>
<ul>
<li>Display name: not unique</li>
<li>Application (client) ID: unique</li>
<li>Object ID: unique</li>
<li>Service principal object ID: unique per tenant instance</li>
</ul>
<p>Humans start with names; Azure enforces uniqueness with IDs. Good naming closes that gap.</p>
<h2 id="good-practice-guidance">Good Practice Guidance</h2>
<h3 id="1-adopt-a-naming-standard">1. Adopt a Naming Standard</h3>
<p>Use a format that encodes identity and purpose, for example:</p>
<p><code>&lt;org&gt;-&lt;workload&gt;-&lt;environment&gt;-&lt;purpose&gt;</code></p>
<blockquote>
<p>Example:</p>
<p>contoso-orders-prod-api</p>
</blockquote>
<h3 id="2-make-environment-explicit">2. Make Environment Explicit</h3>
<p>Always include dev/test/stage/prod in the display name, especially for production.</p>
<h3 id="3-avoid-generic-labels">3. Avoid Generic Labels</h3>
<p>Names like api, webapp, or integration will collide over time.</p>
<h3 id="4-add-ownership-metadata">4. Add Ownership Metadata</h3>
<p>Capture owning team, support channel, and source repo in notes or linked documentation.</p>
<h3 id="5-review-regularly">5. Review Regularly</h3>
<p>Run periodic tenant hygiene checks for:</p>
<ul>
<li>Duplicate names</li>
<li>Missing owner data</li>
<li>Stale or unused app registrations</li>
</ul>
<h2 id="if-you-already-have-duplicates">If You Already Have Duplicates</h2>
<ol>
<li>Inventory duplicates.</li>
<li>Map each app to workload and owner.</li>
<li>Rename to standard format.</li>
<li>Update runbooks and operational docs.</li>
<li>Add pre-create checks so the issue does not return.</li>
</ol>
<h2 id="in-short">In Short</h2>
<p>Yes, you can rename later. In practice, teams usually do not until an incident forces it.</p>
<p>Just because duplicate display names are allowed does not mean they are a good idea.</p>
]]></content:encoded></item></channel></rss>