Forum Discussion

TonyRedmond's avatar
Feb 05, 2025

Interpreting SignIn Audit Records for Service Principals

Entra ID retains audit log records for service principal signins for 30 days. The audit data can reveal some interesting insights such as the presence of unexpected service principals or access to an application from an external source, or even the use of an app secret by an application instead of a more secure method. It’s time to write some PowerShell to interpret the data.

https://office365itpros.com/2025/02/05/service-principal-signins/

No RepliesBe the first to reply

Resources