Type: decision
Entra ID app registration serves as the platform identity, used to provision and configure both the platform and its landing zones.
A managed identity requires an Azure resource as its host, but the platform has no subscription of its own — an app registration exists in Entra ID independently of any Azure infrastructure.