The Azure AD access token documentation describes the appid claim as:
The application ID typically represents an application object, but it can also represent a service principal object in Azure AD
However it doesn't say when it's the application object id, and when it's the service principal object id instead. Does anyone know how it works exactly?
The appid claim value is the value of the appId property on the Application object in Azure AD. It's also known as the client id/application id. The service principals corresponding to the app also have the appId property with the same value.
The objectId property is a different id. The Application object has an objectId, and all related service principals have their own unique objectId values as well. The appid claim will never contain an objectId. It is always the client id of the app that acquired the token.