Forum Discussion
djheyvoon
Jun 17, 2020Iron Contributor
[QUESTION] What is "ServicePrincipal_6387***" / Microsoft Substrate Management account?
Hello Everyone, We have a situation where looking at Audit Logs in our Azure. I found an account that was created (User Adde) by something called "ServicePrincipal_6387c64b-9a8b-4bf1-92e8-******"...
saafee
Feb 22, 2021MCT
I had the same issue after searching around i found that one of my user without any admin role assigned to him used https://outlook.office365.com/ecp to create a distribution group. So I went into default user role assignment in the EOL and unchecked MyDistributionGroups box to avoid a future issue.
As the user is not using Azure ad or Admin center I was seeing the Microsoft Substrate Management in audit logs.