Most applications are a one to one with an Account Store that represents their internal directory.
Applications that share an Account Store would select to use EmpowerID as the Account Store and then link the specific groups to which they wish to grant access to their application.
An application object is not automatically created for each Account Store in EmpowerID.
Any application configured for SSO requires an application object in EmpowerID.
The component for applications and their subcomponents is named ProtectedApplicationResource.
During application onboarding selecting to create a Tracking Only Account Store will create a “logical” Account Store in EmpowerID for access requests and tracking that is not inventoried or managed.