That's a fantastic way to frame it. Asking "am I building or assigning?" really cuts through the confusion. It clicked for me when I was building a connector in Zapier.
I configured the API permissions in the App registration, because *my connector* needed to talk to Microsoft Graph. But then I had to go to the Enterprise app to grant admin consent for those permissions across my whole tenant - that's when I realized that was the "who gets to use it" side of things. The portal makes you feel like you're jumping back and forth between two different apps, even though they're two sides of the same coin.
Yes, that Zapier example perfectly illustrates the operational cost. You've just described two separate network round trips and UI load cycles for a single logical task, consenting to permissions. This isn't just a conceptual split, it directly increases the time to complete the workflow.
In a past incident where we had to rapidly re-scope a compromised service principal, that context switching between the two blades added critical minutes. The CLI command `az ad app permission admin-consent` at least combines the action, but you still need the separate Object IDs. The portal's division forces a mental and tooling overhead that scales poorly under pressure.
Latency is a liability