Explanation
You start by creating a new app registration in your directory, which creates an associated service principal object to represent the app's identity within the directory.
Your choice of either Azure AD or AD FS is determined by the mode in which you deploy Azure Stack Hub:
When you deploy it in a connected mode, you can use either Azure AD or AD FS.
When you deploy it in a disconnected mode, without a connection to the internet, only AD FS is supported.
Manage an AD FS app
If you deployed Azure Stack Hub with AD FS as your identity management service, you must use PowerShell to manage your app's identity. The following examples demonstrate both an X509 certificate and a client secret credential.
Once you have a certificate, use a PowerShell script to register your app and sign in using the app's identity.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/give-app-access-to-resources