Entra app owner added
An owner was added to an Entra ID application or service principal.
What it detects
An owner was added to an Entra ID application or service principal.
Application ownership is a quiet route to durable tenant access. An owner can add credentials to the application at will, so an attacker who owns a highly-privileged app inherits its permissions indefinitely — without holding a directory role, and without tripping any role-assignment monitoring. The grant itself looks like ordinary application administration.
MITRE ATT&CK mapping
- T1098Account Manipulation· Persistence
False positives and triage
Adding a second owner is routine when application administration is handed over or a team takes ownership of an app. The signal is an owner added to an application that holds privileged Graph permissions, an owner who is not an application admin, or an addition close in time to new app credentials — check cloud.identity.m365_app_credential_added for the same application.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/entra_app_owner_added.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_app_owner_added
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1098]
description: |
An owner was added to an Entra ID application or service principal.
Application ownership is a quiet route to durable tenant access. An owner can add
credentials to the application at will, so an attacker who owns a highly-privileged
app inherits its permissions indefinitely — without holding a directory role, and
without tripping any role-assignment monitoring. The grant itself looks like
ordinary application administration.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Add owner to application"
- "Add owner to service principal"
correlation_keys: [target_user_name]
false_positive_guidance: |
Adding a second owner is routine when application administration is handed over or
a team takes ownership of an app. The signal is an owner added to an application
that holds privileged Graph permissions, an owner who is not an application admin,
or an addition close in time to new app credentials — check
`cloud.identity.m365_app_credential_added` for the same application.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.