The app creates a central identity to authenticate and access Azure Resource.
It holds information like:
Azure Active Directory > User settings > App registrations setting.
If set to:
Others:
To access resources in your subscription, you must assign the application to a role.
Go to your resource group and add permission (IAM)