Azure Audit Logs: Service Principal Added via Add service principal Operation

title: "Azure Audit Logs: Service Principal Added via Add service principal Operation"
id: 0011e4ee-35db-40c5-a359-75090de515c8
status: test
description: This rule flags Azure audit log events where the operation name indicates a new service principal was added. Creating service principals can be used to establish new non-interactive identities for API access, which attackers may leverage for stealthy persistence or access to Azure resources. The detection relies on Azure audit log telemetry capturing the specific operation name for the creation action.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_created.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-02
modified: 2026-04-30
tags:
  - attack.stealth
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Add service principal
  condition: selection
falsepositives:
  - Service principal being created may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 0ddcff6d-d262-40b0-804b-80eb592de8e3
    type: derived