Service Principal Sign-in Logs

OperationName	Description	Sample	Rule
any	Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.	Y	Y
Success	Record with ResultType 0: the service principal's client-secret or certificate sign-in completed successfully.	Y	Y
Blocked-by-CA	Record with ResultType 53003 (or one of the further Conditional-Access-related block codes 53000, 53001, 53002, 50131, 50158, 50097): a Conditional Access policy returned a block decision for the service principal's sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.	N	N
Other	Record whose ResultType is not 0 or a Conditional-Access block code. The table's own column doc describes ResultType as Success-or-Failure; this bucket holds every other failure code, for example a credential mismatch or an unregistered application.	Y	N
Target application	Record carrying AppId or ResourceDisplayName: the application identifier and the resource the service principal signed into.	Y	Y
Conditional Access status	Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the service principal's sign-in.	Y	N

any: Sign-in record (AADServicePrincipalSignInLogs, any result)

Description

Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "ServicePrincipalSignInLogs",
  "ClientCredentialType": "clientSecret",
  "ConditionalAccessAudiences": [
    "00000002-0000-0ff1-ce00-000000000000",
    "00000003-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "61f7354f-eb55-447b-816e-0f63a758cb61",
  "CreatedDateTime": "2026-07-25T16:06:55.4060019Z",
  "DurationMs": "0",
  "IPAddress": "203.0.113.10",
  "Id": "ed6df4b6-e2e8-4cc0-8fe6-5ed5bffc2100",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalCredentialKeyId": "3de57a95-5b1d-40af-9546-726a60205eb7",
  "ServicePrincipalId": "6950b93f-27e9-4954-9263-b76d82cbac76",
  "ServicePrincipalName": "dwh-ah-collector",
  "SessionId": "006ea83a-e365-c0f1-726a-097bd4be7dda",
  "UniqueTokenIdentifier": "tvRt7ejiwEyP5l7Vv_whAA",
  "UserAgent": "python-requests/2.34.2"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	16 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`member`	10 rules	elastic
`EventType` (elastic rule field)	eq	`sign-in activity`	7 rules	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	5 rules	elastic
`azure_ad::resource_id` (elastic rule field)	eq	`00000002-0000-0000-c000-000000000000`	3 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0000-c000-000000000000`	4 rules	elastic
`security_result.action (Chronicle)`	eq	`ALLOW`	4 rules	chronicle
`azure_ad::authentication_protocol` (elastic rule field)	eq	`devicecode`	3 rules	elastic
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singlefactorauthentication`	3 rules	elastic
`azure_ad::user_principal_name` (elastic rule field)	is_not_null		3 rules	elastic
`azure.activitylogs.properties.authentication_protocol` (elastic rule field)	eq	`devicecode`	2 rules	elastic
`azure.signinlogs.identity` (elastic rule field)	is_not_null		2 rules	elastic
`azure.signinlogs.properties.authentication_details.authentication_method` (elastic rule field)	eq	`password`	2 rules	elastic
`azure.signinlogs.properties.original_transfer_method` (elastic rule field)	eq	`devicecodeflow`	2 rules	elastic
`azure.signinlogs.properties.token_issuer_type` (elastic rule field)	eq	`azuread`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 or Entra ID Identity Sign-in from a Suspicious Source source high: This rule correlate Entra-ID or Microsoft 365 mail successful sign-in events with network security alerts by source address. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources.T1078
Entra ID Sharepoint or OneDrive Accessed by Unusual Client source medium: Identifies when an application accesses SharePoint Online or OneDrive for Business for the first time in the tenant within a specified timeframe. This detects successful OAuth phishing campaigns, illicit consent grants, or compromised third-party applications gaining initial access to file storage. Adversaries often use malicious OAuth applications or phishing techniques to gain consent from users, allowing persistent access to organizational data repositories without traditional credential theft.T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID OAuth Device Code Flow with Concurrent Sign-ins source high: Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.T1078, T1078.004, T1528, T1566, T1566.002

Show 17 more (31 total) on the rules page

Splunk #

Azure AD Service Principal Authentication source: The following analytic identifies authentication events of service principals in Azure Active Directory. It leverages the azure_monitor_aad data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs. This…T1078, T1078.004
Detect Distributed Password Spray Attempts source: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different…T1110, T1110.003
Azure AD Multi-Source Failed Authentications Spike source: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and…T1110, T1110.003, T1110.004, T1586, T1586.003

Show 1 more (4 total) on the rules page

Kusto #

Service Principal Authentication Attempt from New Country source medium: Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts. Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-insT1078, T1078.004
Lumen TI IPAddress in IdentityLogonEvents source medium: This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in Azure AD sign-in logs.T1071
Suspicious Service Principal creation activity source low: This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes)T1078, T1528

YARA-L #

Entra ID Admin Login Activity to Uncommon MS Cloud Apps source medium: Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
Microsoft Entra ID Device code phishing attack source high: Detects strong indicators of a successful device code phishing attack.T1566
Entra ID Login Activity to Azure AD PowerShell Application source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps

Show 2 more (5 total) on the rules page

Panther #

Azure Device Code Authentication with Broker Client source medium: Detects device code authentication using the Microsoft Broker Client application, which may indicate Primary Refresh Token (PRT) abuse. Device code flow allows adversaries to trick users into entering codes on attacker-controlled applications. When combined with Microsoft Broker Client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e), this may indicate PRT theft or replay attacks that bypass MFA and Conditional Access policies.T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts source high: Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).T1110, T1110.001, T1110.003, T1110.004
Azure Many Failed SignIns source medium: This detection looks for a number of failed sign-ins for the same ServicePrincipalName or UserPrincipalNameT1078, T1110

Show 8 more (11 total) on the rules page

Success: Successful sign-in

Description

Record with ResultType 0: the service principal's client-secret or certificate sign-in completed successfully.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "ServicePrincipalSignInLogs",
  "ClientCredentialType": "clientSecret",
  "ConditionalAccessAudiences": [
    "00000002-0000-0ff1-ce00-000000000000",
    "00000003-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "61f7354f-eb55-447b-816e-0f63a758cb61",
  "CreatedDateTime": "2026-07-25T16:06:55.4060019Z",
  "DurationMs": "0",
  "IPAddress": "203.0.113.10",
  "Id": "ed6df4b6-e2e8-4cc0-8fe6-5ed5bffc2100",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalCredentialKeyId": "3de57a95-5b1d-40af-9546-726a60205eb7",
  "ServicePrincipalId": "6950b93f-27e9-4954-9263-b76d82cbac76",
  "ServicePrincipalName": "dwh-ah-collector",
  "SessionId": "006ea83a-e365-c0f1-726a-097bd4be7dda",
  "UniqueTokenIdentifier": "tvRt7ejiwEyP5l7Vv_whAA",
  "UserAgent": "python-requests/2.34.2"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::result_type` (elastic rule field)	eq	`0`	2 rules	elastic
`azure_ad::signin_category` (elastic rule field)	eq	`serviceprincipalsigninlogs`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access source medium: Detects when a service principal authenticates to Microsoft Entra ID and then lists credentials for an Azure Arc-connected Kubernetes cluster within a short time window. The listClusterUserCredential action retrieves tokens that enable kubectl access through the Arc Cluster Connect proxy. This sequence (service principal sign-in followed by Arc credential retrieval), represents the exact attack chain used by adversaries with stolen service principal secrets to establish a proxy tunnel into Kubernetes clusters. Service principals that authenticate externally (as opposed to managed identities) and immediately access Arc cluster credentials warrant investigation, particularly when the sign-in originates from an unexpected location or ASN.T1078, T1078.004, T1528, T1552, T1552.007
Entra ID Service Principal with Unusual Source ASN source medium: Identifies Entra ID service principal sign-ins where the workload identity and source autonomous system number (ASN) together have not appeared in recent history. Attackers who obtain application secrets or tokens often authenticate from unfamiliar hosting providers, residential or VPN egress, or networks outside normal automation footprints, which can precede data access, lateral movement, or ransomware activity in the tenant. The detection emphasizes first-seen network context for non-interactive workload identities.T1078, T1078.004

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Record with ResultType 53003 (or one of the further Conditional-Access-related block codes 53000, 53001, 53002, 50131, 50158, 50097): a Conditional Access policy returned a block decision for the service principal's sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.

Other: Sign-in with another recorded result

Description

Record whose ResultType is not 0 or a Conditional-Access block code. The table's own column doc describes ResultType as Success-or-Failure; this bucket holds every other failure code, for example a credential mismatch or an unregistered application.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "da91c3ca-c5f2-4538-a970-83ee10968120",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "ServicePrincipalSignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "65b7c0d7-7f29-4a44-be12-bb841705d05a",
  "CreatedDateTime": "2026-07-25T16:03:38.0772751Z",
  "DurationMs": "0",
  "IPAddress": "203.0.113.10",
  "Id": "87978318-f2dd-4d78-9756-7b4c601f0d00",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultDescription": "Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '{identifier}'.",
  "ResultSignature": "FAILURE",
  "ResultType": "7000215",
  "ServicePrincipalId": "cbcffa29-76e0-4573-baab-68503745a452",
  "ServicePrincipalName": "dw-signin-probe",
  "UniqueTokenIdentifier": "GIOXh93yeE2XVntMYB8NAA",
  "UserAgent": "Python-urllib/3.11"
}

Target application: Sign-in naming a target application

Description

Record carrying AppId or ResourceDisplayName: the application identifier and the resource the service principal signed into.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "ServicePrincipalSignInLogs",
  "ClientCredentialType": "clientSecret",
  "ConditionalAccessAudiences": [
    "00000002-0000-0ff1-ce00-000000000000",
    "00000003-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "61f7354f-eb55-447b-816e-0f63a758cb61",
  "CreatedDateTime": "2026-07-25T16:06:55.4060019Z",
  "DurationMs": "0",
  "IPAddress": "203.0.113.10",
  "Id": "ed6df4b6-e2e8-4cc0-8fe6-5ed5bffc2100",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalCredentialKeyId": "3de57a95-5b1d-40af-9546-726a60205eb7",
  "ServicePrincipalId": "6950b93f-27e9-4954-9263-b76d82cbac76",
  "ServicePrincipalName": "dwh-ah-collector",
  "SessionId": "006ea83a-e365-c0f1-726a-097bd4be7dda",
  "UniqueTokenIdentifier": "tvRt7ejiwEyP5l7Vv_whAA",
  "UserAgent": "python-requests/2.34.2"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::app_id` (elastic rule field)	is_not_null		1 rule	elastic
`azure_ad::signin_category` (elastic rule field)	eq	`serviceprincipalsigninlogs`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Service Principal Federated Credential Authentication by Unusual Client source high: Identifies when a service principal authenticates using a federated identity credential for the first time in the historical window. This indicates that Entra ID validated a JWT token potentially against an external OIDC identity provider and issued an access token. While legitimate for CI/CD workflows (GitHub Actions, Azure DevOps), adversaries may abuse this by configuring rogue identity providers (BYOIDP) to authenticate as compromised applications. First-time federated credential usage for a service principal warrants investigation to determine if the external identity provider is legitimate.T1078, T1078.004, T1098, T1098.001, T1550, T1550.001

Conditional Access status: Sign-in recording a Conditional Access status

Description

Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the service principal's sign-in.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "7a5f4796-9012-4dad-a525-8427af2d12c5",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "ServicePrincipalSignInLogs",
  "ClientCredentialType": "clientSecret",
  "ConditionalAccessAudiences": [
    "00000002-0000-0ff1-ce00-000000000000",
    "00000003-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "61f7354f-eb55-447b-816e-0f63a758cb61",
  "CreatedDateTime": "2026-07-25T16:06:55.4060019Z",
  "DurationMs": "0",
  "IPAddress": "203.0.113.10",
  "Id": "ed6df4b6-e2e8-4cc0-8fe6-5ed5bffc2100",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalCredentialKeyId": "3de57a95-5b1d-40af-9546-726a60205eb7",
  "ServicePrincipalId": "6950b93f-27e9-4954-9263-b76d82cbac76",
  "ServicePrincipalName": "dwh-ah-collector",
  "SessionId": "006ea83a-e365-c0f1-726a-097bd4be7dda",
  "UniqueTokenIdentifier": "tvRt7ejiwEyP5l7Vv_whAA",
  "UserAgent": "python-requests/2.34.2"
}

Service Principal Sign-in Logs

any: Sign-in record (AADServicePrincipalSignInLogs, any result)

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

Success: Successful sign-in

Description

Example Sign-in Log Entry #

Common Indicators #

Detection Rules #

Elastic #

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Other: Sign-in with another recorded result

Description

Example Sign-in Log Entry #

Target application: Sign-in naming a target application

Description

Example Sign-in Log Entry #

Common Indicators #

Detection Rules #

Elastic #

Conditional Access status: Sign-in recording a Conditional Access status

Description

Example Sign-in Log Entry #

References #