Translate the term.
Understand the boundary.

Identity model context

Use object type and identifier together

Microsoft identity portals reuse friendly names across different objects. An application registration and its service principal are related but not interchangeable. A device can be registered, Entra joined, hybrid joined, enrolled in Intune, and represented by several identifiers without those records being duplicates.

Search a term to see what it represents, where it lives, and which boundary matters during troubleshooting. The goal is to prevent a display name, client ID, object ID, tenant ID, or device ID from being used in the wrong API, portal, or tenant.

When identity evidence conflicts

• Record the tenant and cloud in which each value was observed
• Identify the object type before comparing identifiers
• Use immutable IDs rather than display names to prove relationships
• Confirm whether the actor is a user, application, managed identity, or device

Authentication proves an identity; authorization determines what that identity can do. Keep those questions separate when investigating token errors, enterprise applications, guest access, device join state, and Microsoft Graph permissions.