Azure Audit Logs: Service Principal Removal

title: "Azure Audit Logs: Service Principal Removal"
id: 449d4411-eaf7-4edb-984b-975e8b823d29
status: test
description: This rule identifies Azure audit log events where the operation is "Remove service principal," indicating a service principal object was deleted. Removing a service principal can be used to disrupt or conceal authenticated access by invalidating an identity used by apps or automation. The detection relies on Azure audit log telemetry, specifically the operation name recorded for directory changes.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_removed.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
  - attack.stealth
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Remove service principal
  condition: selection
falsepositives:
  - Service principal being removed may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 448fd1ea-2116-4c62-9cde-a92d120e0f08
    type: derived