Forum Discussion
djheyvoon
Jun 17, 2020Iron Contributor
[QUESTION] What is "ServicePrincipal_6387***" / Microsoft Substrate Management account?
Hello Everyone, We have a situation where looking at Audit Logs in our Azure. I found an account that was created (User Adde) by something called "ServicePrincipal_6387c64b-9a8b-4bf1-92e8-******"...
MPabon
Jul 08, 2020Copper Contributor
Did you ever find an answer to this? I'm seeing the same thing in our system. A random account being created by a "ServicePrincipal" account.
- djheyvoonAug 10, 2020Iron ContributorNo. I haven't found anything! This is very weird.
- sfsfsfsfsdfsdfJul 08, 2020Copper Contributor
MPabon Same here. No information yet on what caused it.
- djheyvoonAug 10, 2020Iron ContributorNobody from M$ will say anything? Funny!
- MPabonAug 10, 2020Copper Contributor
I decided to search again and found this post from last week. https://www.jasonfritts.me/2020/08/04/what-is-microsoft-substrate-management-and-why-is-it-creating-users-in-my-tenant/
What's weird is the account that "ServicePrincipal" account created was not an account that I have ever created. So this may explain it for others but my situation is still a bit of a mystery.