Azure Audit Logs: Service Principal Removed via Remove service principal

title: "Azure Audit Logs: Service Principal Removed via Remove service principal"
id: 449d4411-eaf7-4edb-984b-975e8b823d29
status: test
description: This rule flags Azure audit log events where the operationName indicates a service principal was removed. Removing a service principal can disrupt access to applications and may be used by an attacker to reduce persistence or invalidate previously used credentials. Detection relies on Azure audit logs capturing the specific "Remove service principal" operationName.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_service_principal_removed.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
  - attack.stealth
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Remove service principal
  condition: selection
falsepositives:
  - Service principal being removed may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 448fd1ea-2116-4c62-9cde-a92d120e0f08
    type: derived