Azure Audit Logs: Service Principal Removed via Remove service principal
Flags Azure audit log events where a service principal is removed from Entra ID.
FreeReviewedSigma · Medium · v5
- Product
- azure
- Service
- auditlogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-03
- Updated
- 2026-07-31
What it detects
This rule flags Azure audit log events where the operationName indicates a service principal was removed. Removing a service principal can disrupt access to applications and may be used by an attacker to reduce persistence or invalidate previously used credentials. Detection relies on Azure audit logs capturing the specific "Remove service principal" operationName.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- techcommunity.microsoft.comhttps://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_removed.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-audit-logs-service-principal-removal-448fd1ea
title: "Azure Audit Logs: Service Principal Removed via Remove service principal"
id: 449d4411-eaf7-4edb-984b-975e8b823d29
status: test
description: This rule flags Azure audit log events where the operationName indicates a service principal was removed. Removing a service principal can disrupt access to applications and may be used by an attacker to reduce persistence or invalidate previously used credentials. Detection relies on Azure audit logs capturing the specific "Remove service principal" operationName.
references:
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_removed.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
- attack.stealth
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName: Remove service principal
condition: selection
falsepositives:
- Service principal being removed may be performed by a system administrator.
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 448fd1ea-2116-4c62-9cde-a92d120e0f08
type: derived