Azure Audit Logs: Service Principal Created via Add service principal

title: "Azure Audit Logs: Service Principal Created via Add service principal"
id: 0011e4ee-35db-40c5-a359-75090de515c8
status: test
description: This rule flags Azure audit events where an operation named "Add service principal" occurs, indicating a new service principal was created. Attackers commonly create service principals to obtain non-human identities for accessing resources and maintaining persistence while avoiding interactive logon activity. Detection relies on Azure audit log telemetry capturing the operationName field for directory changes.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_created.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-02
modified: 2026-04-30
tags:
  - attack.stealth
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Add service principal
  condition: selection
falsepositives:
  - Service principal being created may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 0ddcff6d-d262-40b0-804b-80eb592de8e3
    type: derived