Under Select, search for your app using a full or partial Application Name. During registration, the Application Name is generated as Azurestack-<YourAppName>-<ClientId>. For example, if you used an application name of App2, and ClientId 2bbe67d8-3fdb-4b62-87cf-cc41dd4344ff was assigned during creation, the full name would be Azurestack-App2-2bbe67d8-3fdb-4b62-87cf-cc41dd4344ff. You can search for either the exact string, or a portion, like Azurestack or Azurestack-App2.
Note: An Application ID, sometimes referred to as a Client ID. A GUID that uniquely identifies the app's registration in your Active Directory tenant.

Create a new cloudadmin user named User2.
Add a new Azure Stack Hub user account in Azure Active Directory (Azure AD) Before you can test offers and plans and create resources, you'll need a user account for the Azure Stack Hub user portal. You create a user account in your Azure AD tenant, by using the Azure portal or PowerShell.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-add-new-user-aad

Your choice of either Azure AD or AD FS is determined by the mode in which you deploy Azure Stack Hub:
When you deploy it in a connected mode, you can use either Azure AD or AD FS.
When you deploy it in a disconnected mode, without a connection to the internet, only AD FS is supported.
E:
Rotate certificate for AD FS identity application
The identity application is created by the operator before deployment of Azure App Service on Azure Stack Hub. If the application's object ID is unknown, follow these steps to discover it:
Go to the Azure Stack Hub administrator portal.
Go to Subscriptions and select Default Provider Subscription.
Select Access Control (IAM) and select the AzureStack-AppService-<guid> application.
Take a note of the Object ID, this value is the ID of the Service Principal that must be updated in AD FS.
D: To rotate the certificate for the application in AD FS, you need to have access to the privileged endpoint (PEP). Then you update the certificate credential using PowerShell.
# Sign in to PowerShell interactively, using credentials that have access to the VM running the Privileged Endpoint
$Creds = Get-Credential
# Create a new Certificate object from the identity application certificate exported as .cer file
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("<CertificateFileLocation>")
# Create a new PSSession to the PrivelegedEndpoint VM
$Session = New-PSSession -ComputerName "<PepVm>" -ConfigurationName PrivilegedEndpoint -Credential $Creds -SessionOption (New-PSSessionOption -Culture en-US -UICulture en-US)
# Use the privileged endpoint to update the certificate thumbprint, used by the service principal associated with the App Service identity application
$SpObject = Invoke-Command -Session $Session -ScriptBlock {Set-GraphApplication -ApplicationIdentifier "<ApplicationObjectId>" -ClientCertificates $using:Cert}
$Session | Remove-PSSession
# Output the updated service principal details
$SpObject
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-identity-overview
https://learn.microsoft.com/en-us/azure-stack/operator/app-service-rotate-certificates

Reference:
https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-backup-enable-backup-console?view=azs-2008