Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Azure CLI Service Principal or Enterprise applications duplications removal
EnterpriseArchitect
6,411
Reputation points
When browsing to the Enterprise applications | All applications portal GUI https://entra.microsoft.com/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview
I can see that there are a few hundred duplications of Azure CLI Service Principal or Enterprise Apps in this format, dating back to 2016 and continuing up to the most recent 2026.
azure-cli-YYYY-MM-dd-hh-mm-ss
The homepage URL is not accessible when executed from the browser, but the Activation status are all Activated.
The Service Principal Type is Application.
The AppType is App registration.
Service Principal last used all shows as blank or never. I guess there is no activity recorded over 30 days.
Most of them have no owner assigned, no App passwords, and have expiring credentials.
Which one can I safely delete or must be kept ?
Why are those being duplicated multiple times?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 10%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator2026-01-07T08:56:31.4433333+00:00 Hey there! It seems like you're facing an issue with the duplication of Azure CLI Service Principals or Enterprise Applications in your Microsoft Entra environment. Let's tackle your questions and concerns!
Understanding the Duplications:
The reason you may be seeing multiple entries of the same Azure CLI Service Principal could stem from different registrations or configurations made over time. Each entry you see that includes the timestamp format (
azure-cli-YYYY-MM-dd-hh-mm-ss) represents a separate instantiation of the Azure CLI service principal, which might be created upon re-running certain commands or automations that register the app without checking for existing instances.Safe Deletion:
When it comes to safely deleting these duplicates, here are some points to consider:
- Last Used Information: If the service principals show "Last Used: Never" or are blank, then they likely haven’t been utilized, which can be a sign that they might be safe to remove.
- Owner Assignment: Duplicates without an owner and no app passwords are generally considered non-essential.
- Expiry Status: If they have expiring credentials and you are unsure of their usage, that further indicates that they might be candidates for deletion.
Next Steps You Can Take:
- Review and Assess: For each duplicate, assess based on usage and necessity:
- Check if an application is actively being utilized.
- Review application permissions to ensure no essential functions will be disrupted by the deletion.
- Delete Unused Service Principals: To delete a service principal, ensure there is a service principal object associated with it. Use PowerShell or Azure CLI commands:
- PowerShell:
Remove-MgServicePrincipal -ServicePrincipalId <ServicePrincipalID> - Azure CLI:
az ad sp delete --id <ServicePrincipalID>
- PowerShell:
- Keep Critical Service Principals: Ensure to retain any critical applications tied to the Azure services you actively use.
Follow-Up Questions for Further Clarification:
- How frequently do you run automations or scripts that may create service principals?
- Are there specific applications you know are actively using any of the service principals?
- Do you have a backup or a way to revert changes if deleting turns out to be problematic?
- Are there specific constraints or policies in your organization regarding app deletion?
By considering the above points and asking the right questions, you can make informed decisions about which service principals to delete while ensuring critical applications remain operational. Hope this helps!
-
EnterpriseArchitect 6,411 Reputation points
2026-01-07T09:34:53.4533333+00:00 @Shubham Sharma ,
What about the Soft Delete feature? Can we restore it before the time lapses? -
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator
2026-01-13T09:13:40.4933333+00:00 yes, but only in very specific cases—and only within a limited time window.
When you delete an Enterprise Application (Service Principal):
- The object is soft-deleted
- It moves to the Deleted directory objects container
- It stays there for ~30 days
- During this window, restoration is possible
- After that, deletion becomes permanent (hard delete)
This behavior is the same for:
- Enterprise Applications (Service Principals)
- App Registrations
- Users
- Groups
Can Azure CLI Service Principals be restored?
Yes, IF all of the following are true:
ConditionRequiredDeletion happened < ~30 days ago
Object appears under Deleted objects
It was deleted (not auto‑purged by tenant cleanup)
You have Entra ID admin privileges
No, if:
The object aged out of the deleted container
It was hard‑deleted via Graph API DELETE + purge
Tenant retention was shortened (rare)
Sign in to comment
Sign in to answer