After registering an enterprise application in a subscription linked to an Azure AD tenant, which additional Azure AD resource is automatically created?

When you register an enterprise application in Azure AD, a service principal object is automatically created in the tenant. The service principal acts as the application's identity within that specific Azure AD tenant, defining what the application can access and do. It's essentially an instance of the application object in a directory. An X.509 certificate is used for authentication but is not automatically created as a separate Azure AD resource upon application registration. A managed identity is a specific type of service principal used for Azure resources to authenticate to cloud services, not for general enterprise application registration. A user account represents a human user and is distinct from an application's identity.