Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Service principal

The identity of an application in a Microsoft Entra tenant, used by automation to call Azure with a client secret, certificate or federated credential.

A service principal is the tenant-local identity of an application registration (or of a managed identity). Automation such as CI/CD pipelines uses it to call Azure Resource Manager with a client secret, a certificate or a federated credential.

In the Activity Log its caller is a GUID and its claims include appid and an object ID. Leaked secrets of over-privileged service principals are a common way into Azure subscriptions; a service principal calling from an IP never seen before is a strong signal (MITRE T1078.004). Credential changes are recorded in Entra ID audit logs.

See managed identity and service principal abuse.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.