Forum Discussion
djheyvoon
Jun 17, 2020Iron Contributor
[QUESTION] What is "ServicePrincipal_6387***" / Microsoft Substrate Management account?
Hello Everyone, We have a situation where looking at Audit Logs in our Azure. I found an account that was created (User Adde) by something called "ServicePrincipal_6387c64b-9a8b-4bf1-92e8-******"...
Feb 24, 2021
Hi djheyvoon,
can someone verify if there was a SaaS subscription to a product that use this account for "for example" impersonation for a certain service, the thig that came to my mind is that there is a service that taken authorization to create an account to be used by a SaaS application!!!
try to see if there is any correlation with an application that was installed at the date the account appeared.
Hope it helps!