When I have a SharePoint 2013 site (on premises) configured for Add-ins/Apps, and I navigate to http(s)://(my sharepoint site domain)/_layouts/15/appprincipals.aspx, I see all the app principals I have registered for my Add-ins, but I also see a special app principal called "SharePoint" which always has the App Identifier (a.k.a ClientID) of 00000003-0000-0ff1-ce00-000000000000@(tenancy id).

My first question is:

  • How does this app principal get created? Does it get created when you configure the "App Management Service"? When you configure your first app? Sometime else?

My next question is:

  • What is the purpose of this app principal?

I have a customer who is having problems setting up Apps for SharePoint (trouble with User Profile Service, distributed caching service, etc.), and appregnew.aspx is not currently working for them.

Once they work through all of these problems, I'm a little concerned that this particular app principal won't exist (it currently doesn't; appregnew.aspx seems to work with no errors on submit, but no app principals ever show up), and I'm wondering (for my final question):

  • How can I force this special app principal to be created?

1 Answer 1


How does this app principal get created? Does it get created when you configure the "App Management Service"? When you configure your first app? Sometime else?

  • When an app required permission to access information inside you site collection and if you trust that app then these AppPrinciple gets created. You can see them /_layouts/15/appprincipals.aspx and you can also trust an App using this link /_layouts/15/appinv.aspx. App Principal is very much like a user principal which you can give permissions to in SharePoint.

The first time it makes a request to a SharePoint site, you will get an App trust dialog – just like you do when you install an App from the App Catalog. This is going to be as close as you get to “installing” the application – what it’s really doing is just creating an App Principal

Read more over here: he has 8 parts, please go through them to understand it.

Security in SharePoint Apps – Part 1


  • I'm not talking about the app principal that gets created when I trust a new app. I'm talking about a special, single App Principal that gets created on all SharePoint sites, and that always has the ID 00000003-0000-0ff1-ce00-000000000000@(tenancy id). If you were to setup a SharePoint site with a single app, and then navigate to apprincipals.aspx, you would see two (not one) app principals -- the one for the app you just trusted, and also this special app principal called "SharePoint". My questions are related to this special app principal which is created before any apps are trusted. Jan 28, 2016 at 0:47
  • 1
    that is default app principle which is created with creation of Site collection. its title is SharePoint and it is being used for the Security token service at leaset i know about it.
    – Waqas Sarwar MVP
    Jan 28, 2016 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.