Understand Why a Service Principal Was Created in Your Entra Tenant

Are you a tenant admin or member of a security team in your organization and find yourself asking “Why was this service principal created in our tenant?”

Historically, answering this required correlating audit logs with Microsoft Graph queries or going through long investigations. Microsoft Entra now introduces enhanced audit log properties that make it significantly easier to understand the origin and intent behind newly created service principals directly from tenant audit logs. These new improvements surface additional insights within the Add service principal activity under the ApplicationManagement category—helping administrators determine whether a service principal was provisioned automatically by Microsoft services, triggered by a purchased subscription, or explicitly created by user or application activity.

What’s in it for me as an Admins or member of the Security Team
When a service principal is created, new metadata is now captured within Microsoft Entra audit logs that enables faster root‑cause analysis. These properties help distinguish between Microsoft‑driven provisioning processes and tenant‑initiated actions, allowing teams to quickly assess whether an event is expected platform behavior or something requiring deeper investigation.

For example, administrators can now:

• Identify provisioning initiated by Microsoft services versus internal users or automation.
• Determine which tenant subscription or service plan enabled just‑in‑time provisioning.
• Recognize provisioning linked to Azure resource onboarding or managed identities.
• Investigate service principal creation without relying on additional Graph lookups.

By leveraging these enriched audit logs, security teams can streamline investigations into newly created enterprise applications and reduce manual dependency on downstream data sources. This ultimately improves visibility into application onboarding events and supports faster decision‑making when assessing potential risk or unexpected provisioning activity within the tenant.

Learn more here- Understand why a service principal was created in your tenant - Microsoft Entra ID | Microsoft Learn