Hello All,
I keep coming across entries in our Azure Audit Logs off the Entra ID portal showing that existing applications in our environment are creating events showing that it's adding itself as a service principal.
For Example.
We have had the 'Microsoft Managed Policy Manager' application in our environment for quite some time, yet I recently came across an entry in the Audit Log showing the name andGUID for 'Microsoft Managed Policy Manager' in the 'ActorServicePrincipalID' & 'ActorServicePrincipalName'; moreover, the details in the target fields were all related to 'Microsoft Managed Policy Manager' and it's subsequent details.
I'm looking for some guidance on how to track down what might be going on with this Audit Log or if this is normal/expected behaviour...
