Forum Discussion
Unexpected Service Principal Additions After Purview Label Schema Migration
Hi everyone, I recently migrated our Microsoft Purview label schema in our tenant and noticed some interesting audit log entries right after the migration. Specifically, Entra ID recorded Add servic...
Hi Stephan,
Yes, this is expected. When you migrate a Purview label schema, Purview updates its backend services and may automatically create or update first‑party service principals (including the Purview API). This aligns with how Unified Catalog and governance components operate.
The kiota-dotnet user agent also fits, since Purview uses Microsoft Graph under the hood.
These service principals are standard Microsoft‑owned components and are required for Purview’s functionality.
What to check:
- Publisher = Microsoft
- App IDs match Microsoft‑owned first‑party apps
- Activity timestamp aligns with your migration
If those match, the additions are legitimate.
Hope this helps, feel free to mark as solution if it did. 😁