Azure Audit Logs: Service Principal Created via Add service principal
Alerts on Azure audit log events that add a new service principal.
FreeReviewedSigma · Medium · v5
- Product
- azure
- Service
- auditlogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-02
- Updated
- 2026-07-31
What it detects
This rule flags Azure audit events where an operation named "Add service principal" occurs, indicating a new service principal was created. Attackers commonly create service principals to obtain non-human identities for accessing resources and maintaining persistence while avoiding interactive logon activity. Detection relies on Azure audit log telemetry capturing the operationName field for directory changes.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- analyticsrules.exchangehttps://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_created.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-audit-logs-service-principal-added-via-add-service-principal-operation-0ddcff6d
title: "Azure Audit Logs: Service Principal Created via Add service principal"
id: 0011e4ee-35db-40c5-a359-75090de515c8
status: test
description: This rule flags Azure audit events where an operation named "Add service principal" occurs, indicating a new service principal was created. Attackers commonly create service principals to obtain non-human identities for accessing resources and maintaining persistence while avoiding interactive logon activity. Detection relies on Azure audit log telemetry capturing the operationName field for directory changes.
references:
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_created.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-02
modified: 2026-04-30
tags:
- attack.stealth
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName: Add service principal
condition: selection
falsepositives:
- Service principal being created may be performed by a system administrator.
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 0ddcff6d-d262-40b0-804b-80eb592de8e3
type: derived