Defender-AADSpnSignInEventsBeta

any: Entra ID service principal sign-in (beta predecessor)

#
Table
AADSpnSignInEventsBeta

Example Event #

{
  "Application": "dwh-ah-collector",
  "ApplicationId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "City": "Redacted",
  "CorrelationId": "d128fb8f-04e0-47bd-85af-22528383778a",
  "Country": "US",
  "ErrorCode": 0,
  "IPAddress": "203.0.113.10",
  "IsConfidentialClient": 1,
  "IsConfidentialClient@odata.type": "#SByte",
  "IsManagedIdentity": 0,
  "IsManagedIdentity@odata.type": "#SByte",
  "Latitude": "0.0",
  "Longitude": "0.0",
  "ReportId": "db117b2a-c01b-4d62-a9b7-63511148c9ac",
  "RequestId": "19c028bd-92fe-4d2b-ba61-c5f244e10200",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceId": "00000003-0000-0000-c000-000000000000",
  "ResourceTenantId": "00000000-0000-0000-0000-000000000001",
  "ServicePrincipalId": "6950b93f-27e9-4954-9263-b76d82cbac76",
  "ServicePrincipalName": "dwh-ah-collector",
  "State": "Redacted",
  "Timestamp": "2026-08-01T16:31:12.262278Z"
}

References #