Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Enterprise tenants often accumulate hundreds of App Registrations and Service Principals created for pilot projects and then forgotten. When client secrets or certificates for these abandoned applications leak (e.g., via hardcoded repository commits), adversaries leverage them to gain authenticated cloud access without triggering standard MFA policies.

This rule baselines service principal activity and alerts when a dormant application suddenly wakes up.

Log Source

• Microsoft Entra ID: AADServicePrincipalSignInLogs

Dormant Service Principal Detection Query

// Alert on Sudden Activity from Service Principals Inactive for > 60 Days
let observationWindow = 1d;
let baselineLookback = 60d;
let activeToday = 
    AADServicePrincipalSignInLogs
    | where TimeGenerated >= ago(observationWindow)
    | where ResultType == 0
    | summarize 
        RecentSignins = count(),
        LastSeenToday = max(TimeGenerated),
        CallerIPs = make_set(IPAddress, 5)
        by ServicePrincipalId, ServicePrincipalName;
let historicalActivity = 
    AADServicePrincipalSignInLogs
    | where TimeGenerated between (ago(baselineLookback) .. ago(observationWindow))
    | where ResultType == 0
    | summarize HistoricCount = count() by ServicePrincipalId;
activeToday
| join kind=leftouter (historicalActivity) on ServicePrincipalId
| where isnull(HistoricCount) or HistoricCount == 0
| project ServicePrincipalName, ServicePrincipalId, RecentSignins, LastSeenToday, CallerIPs
| order by RecentSignins desc

Query Logic

1. Recent Active Cohort: Identifies applications successfully signing in during the past 24 hours.
2. Historical Comparison: Checks if that same ServicePrincipalId generated zero log events during the preceding 60 days.
3. Investigation: Correlate the CallerIPs against known enterprise developer VPNs or CI/CD pipelines (e.g., GitHub Actions, Azure DevOps).

MITRE ATT&CK Mapping

• Tactic: Privilege Escalation (TA0004), Persistence (TA0003)
• Technique: Account Manipulation: Additional Cloud Credentials (T1098.001), Valid Accounts: Cloud Accounts (T1078.004)