Registering Mobile Apps as Separate Enterprise Applications in Entra ID

Question

Registering Mobile Apps as Separate Enterprise Applications in Entra ID

Kylee Kasper 40

Is it possible to register a mobile application that uses corporate SSO as its own Enterprise Application in Entra ID, distinct from other related applications, to enable the application of Conditional Access policies specifically for that mobile app? For instance, could MFA or device compliance requirements be uniquely scoped to that app while keeping different Conditional Access rules for other applications within the same ecosystem?

Here is the use case: we are a software company that offers a desktop application and a mobile app, which displays limited data and PII for security purposes. Our customers currently have access policies to prevent their employees from logging into the desktop version on non-corporate managed devices. However, this setup restricts the use of the mobile application. If they allow access from non-corporate managed devices (including personal mobile phones), they risk compromising their security protocols.

One potential workaround is to register the mobile app as its own application in Entra ID. This approach is desired to: 1. enable the application of different/separate protections for the desktop and mobile applications, and 2. register the mobile app as its own enterprise application, even though it would still connect to the same IdP integration.

Carolyne Milgo 1,151 Reputation points

2025-10-02T07:20:18.27+00:00

Hello Kylee!
Thanks for reaching out.

This is possible. Please review the official documentation linked below.
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-filter-for-applications
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2025-12-08T05:09:39.35+00:00
Hello Kylee Kasper,

Yes, this is possible, but only by using separate App Registrations for the desktop and mobile applications.

Conditional Access policies are applied to Enterprise Applications (service principals), which are created automatically from App Registrations. If both your desktop and mobile apps use the same App Registration (same App ID), they will always be subject to the same Conditional Access policies, and there is no supported way to separate them.

To apply different security controls, you must:

Create one App Registration for the desktop app

Create a second, separate App Registration for the mobile app

This will result in two different Enterprise Applications, allowing you to target each one independently with Conditional Access. For example:

The desktop app can require compliant or corporate-managed devices.

The mobile app can allow personal devices while enforcing MFA, approved apps, or Intune App Protection (MAM).

Both applications can continue to use the same Entra tenant and the same identity provider integration. Only the App IDs and Conditional Access policies need to be different.

It is not supported to create multiple Enterprise Applications from a single App Registration for Conditional Access separation.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2025-12-09T02:00:10.2+00:00

Hello Kylee Kasper,

Just checking in to see if the above comment helped you in any way or not. Feel free to reach out for any further queries!

Your answer

Carolyne Milgo 1,151 Reputation points

2025-10-02T07:20:18.27+00:00

Hello Kylee!
Thanks for reaching out.

This is possible. Please review the official documentation linked below.
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-filter-for-applications
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2025-12-08T05:09:39.35+00:00

Hello Kylee Kasper,

Yes, this is possible, but only by using separate App Registrations for the desktop and mobile applications.

Conditional Access policies are applied to Enterprise Applications (service principals), which are created automatically from App Registrations. If both your desktop and mobile apps use the same App Registration (same App ID), they will always be subject to the same Conditional Access policies, and there is no supported way to separate them.

To apply different security controls, you must:

Create one App Registration for the desktop app

Create a second, separate App Registration for the mobile app

This will result in two different Enterprise Applications, allowing you to target each one independently with Conditional Access. For example:

The desktop app can require compliant or corporate-managed devices.

The mobile app can allow personal devices while enforcing MFA, approved apps, or Intune App Protection (MAM).

Both applications can continue to use the same Entra tenant and the same identity provider integration. Only the App IDs and Conditional Access policies need to be different.

It is not supported to create multiple Enterprise Applications from a single App Registration for Conditional Access separation.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2025-12-09T02:00:10.2+00:00

Hello Kylee Kasper,

Just checking in to see if the above comment helped you in any way or not. Feel free to reach out for any further queries!