Microsoft 365 service principal added
A service principal / enterprise application was added, or an app was granted a directory role or delegated permission, in Microsoft Entra ID.
What it detects
A service principal / enterprise application was added, or an app was granted a directory role or delegated permission, in Microsoft Entra ID. Attackers add a rogue app or service principal (often with a client secret they control) and grant it broad Graph permissions to establish durable, user-independent access to mail and files that survives password resets and MFA.
MITRE ATT&CK mapping
False positives and triage
Admins and automation register apps legitimately. The signal is an app added by an unexpected account, granted high-privilege Graph permissions (Mail.ReadWrite, full_access_as_app), or added right after a suspicious sign-in / consent grant. Review the app, its credentials, and the permissions granted.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_service_principal_added.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_service_principal_added
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1098.003, T1136.003]
description: |
A service principal / enterprise application was added, or an app was granted a
directory role or delegated permission, in Microsoft Entra ID. Attackers add a
rogue app or service principal (often with a client secret they control) and
grant it broad Graph permissions to establish durable, user-independent access
to mail and files that survives password resets and MFA.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Add service principal"
- "Add app role assignment"
- "Add delegated permission grant"
- "Add OAuth2PermissionGrant"
correlation_keys: [target_user_name]
false_positive_guidance: |
Admins and automation register apps legitimately. The signal is an app added by
an unexpected account, granted high-privilege Graph permissions (Mail.ReadWrite,
full_access_as_app), or added right after a suspicious sign-in / consent grant.
Review the app, its credentials, and the permissions granted.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.