Agent Foskett Case File • Microsoft Entra ID • Workload Identities • Certificates • Microsoft Graph • KQL
The Certificate Was Valid — But Nobody Knew Who Was Using It
The sign-in succeeded.
The certificate was valid. The application had permission to access Microsoft Graph. Nothing in the authentication result looked particularly dramatic.
There was just one problem.
Nobody on the security team recognised the application.
“The certificate is valid,” the analyst said.
“Lovely,” Agent Foskett replied. “And who authorised it?”
“We haven't found anyone.”
“Then I suggest we stop congratulating the certificate.”
Case file: Authentication success is not authorisation
A fictional, evidence-led investigation into an unfamiliar application identity, certificate credentials, service principal sign-ins, app role assignments and the limits of what identity telemetry can prove.
✓ Identify the service principal and credential
✓ Correlate sign-ins with audit and permission changes
✓ Determine whether resource activity supports misuse
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
// Microsoft Sentinel / Log Analytics — requires OfficeActivity ingestion
let StartUtc = datetime(2026-10-13T15:30:00Z);
let EndUtc = datetime(2026-10-13T17:30:00Z);
OfficeActivity
| where TimeGenerated between (StartUtc .. EndUtc)
| where Operation has_any ("Retention", "CompliancePolicy", "ComplianceRule")
or tostring(Parameters) has_any ("Retention", "CompliancePolicy")
| project TimeGenerated, OfficeWorkload, Operation, UserId,
ClientIP, OfficeObjectId, Parameters
| order by TimeGenerated asc- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
// Microsoft Sentinel — requires Entra SigninLogs ingestion
let TargetAdmin = "compliance.admin@contoso.com";
let StartUtc = datetime(2026-10-13T15:30:00Z);
let EndUtc = datetime(2026-10-13T17:30:00Z);
SigninLogs
| where TimeGenerated between (StartUtc .. EndUtc)
| where UserPrincipalName =~ TargetAdmin
| project TimeGenerated, UserPrincipalName, AppDisplayName,
IPAddress, ResultType, ConditionalAccessStatus,
AuthenticationRequirement, DeviceDetail, LocationDetails
| order by TimeGenerated asc- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
// Microsoft Sentinel — requires Entra AuditLogs ingestion
let StartUtc = datetime(2026-10-13T14:00:00Z);
let EndUtc = datetime(2026-10-13T18:00:00Z);
AuditLogs
| where TimeGenerated between (StartUtc .. EndUtc)
| where Category in~ ("RoleManagement", "UserManagement", "ApplicationManagement")
| project TimeGenerated, Category, OperationName, Result,
InitiatedBy, TargetResources, CorrelationId
| order by TimeGenerated ascAn application nobody could explain
The fictional organisation operated several automation jobs using Microsoft Entra ID workload identities. During a scheduled access review, an analyst noticed a successful service principal sign-in for an application named Legacy Reporting Connector. Its certificate credential was still valid, but the application had no documented owner, no current change record and no entry in the approved integration register.
The team did not immediately label the activity malicious. An old but legitimate integration, a renamed application or an undocumented deployment could produce similar evidence. The investigation began with the identity itself.
The team did not immediately label the activity malicious. An old but legitimate integration, a renamed application or an undocumented deployment could produce similar evidence. The investigation began with the identity itself.
The sign-in succeededEntra ID accepted an application credential; that alone did not establish business approval.
The owner was unknownThe team could not match the application to a maintained service or accountable owner.
The permissions matteredApplication permissions could allow access without a user being present.
First, identify the right object
In Microsoft Entra ID, an application registration describes an application, while a service principal is its enterprise-application identity in a tenant. Record the application (client) ID, application object ID, service principal object ID, tenant ID, display name, owners, credential metadata, and current app role assignments. These identifiers are related but are not interchangeable.
Use the Entra admin centre or Microsoft Graph with appropriately authorised read permissions to capture the current configuration. Preserve the evidence before making changes. A certificate thumbprint identifies a certificate, but does not establish who possesses its private key.
Use the Entra admin centre or Microsoft Graph with appropriately authorised read permissions to capture the current configuration. Preserve the evidence before making changes. A certificate thumbprint identifies a certificate, but does not establish who possesses its private key.
Find the workload identity sign-ins
The first KQL query uses the
In this illustrative case, replace the example application ID and dates with the values from your own investigation. Review both successful and failed sign-ins; successful authentication is the starting point, not the conclusion.
AADServicePrincipalSignInLogs table in a Microsoft Sentinel / Log Analytics workspace. It works only when the relevant Entra diagnostic logs are routed to that workspace and retained. It does not run unchanged in Microsoft Defender XDR Advanced Hunting.In this illustrative case, replace the example application ID and dates with the values from your own investigation. Review both successful and failed sign-ins; successful authentication is the starting point, not the conclusion.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
// Microsoft Sentinel / Log Analytics — requires service principal sign-in logs
let TargetAppId = "11111111-2222-3333-4444-555555555555";
let StartUtc = datetime(2026-10-19T00:00:00Z);
let EndUtc = datetime(2026-10-21T00:00:00Z);
AADServicePrincipalSignInLogs
| where TimeGenerated between (StartUtc .. EndUtc)
| where AppId =~ TargetAppId
| project TimeGenerated, AppId, ServicePrincipalId,
ServicePrincipalName, ResourceDisplayName,
IPAddress, ResultType, ResultDescription,
CorrelationId, CredentialKeyId
| order by TimeGenerated ascWhere did the authentication originate?
Agent Foskett grouped the observed sign-ins by source address, target resource and outcome. An unfamiliar IP address is a lead, not proof of compromise: cloud hosting, proxies, NAT and approved vendors can all complicate attribution. Compare the address against known automation infrastructure, vendor ranges, deployment records and the application’s normal pattern.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
// Microsoft Sentinel / Log Analytics — same data prerequisite
let TargetAppId = "11111111-2222-3333-4444-555555555555";
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(14d)
| where AppId =~ TargetAppId
| summarize SignIns=count(),
FirstSeen=min(TimeGenerated),
LastSeen=max(TimeGenerated),
Results=make_set(ResultType, 10)
by IPAddress, ResourceDisplayName
| order by LastSeen descWas the certificate recently added or replaced?
The investigation then moved to Entra directory audit logs. The team looked for updates to application and service principal objects, credential additions or removals, ownership changes and app role assignments. The operation name and structure of
The example query is a broad triage search. Validate candidate events against the complete audit record, object IDs and credential metadata.
TargetResources can vary, so inspect the original event rather than treating a text match as definitive proof that a certificate was added.The example query is a broad triage search. Validate candidate events against the complete audit record, object IDs and credential metadata.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
// Microsoft Sentinel — requires Entra AuditLogs ingestion
let TargetAppId = "11111111-2222-3333-4444-555555555555";
AuditLogs
| where TimeGenerated > ago(30d)
| where Category in~ ("ApplicationManagement", "RoleManagement")
| extend Targets=tostring(TargetResources)
| where Targets has TargetAppId
or OperationName has_any ("application", "service principal", "app role")
| project TimeGenerated, OperationName, Category,
Result, InitiatedBy, TargetResources,
CorrelationId
| order by TimeGenerated ascWhat could the application actually do?
A successful sign-in to Microsoft Graph does not reveal every API call that followed. The team reviewed the service principal’s app role assignments and any delegated grants, distinguishing permissions that were requested from those actually granted. They checked whether sensitive application permissions, such as directory or mail access, had been approved and whether the relevant resource exposed usable activity logs.
Permissions describe potential access, not confirmed data retrieval. An investigator should not claim that mailboxes were read or files exported merely because a permission exists. Resource-specific telemetry and audit evidence are needed to establish what was accessed.
Permissions describe potential access, not confirmed data retrieval. An investigator should not claim that mailboxes were read or files exported merely because a permission exists. Resource-specific telemetry and audit evidence are needed to establish what was accessed.
CredentialWhich key or certificate credential was used, and when was it registered?
IdentityWhich tenant service principal signed in, and who owns the application?
PrivilegeWhich app roles or consent grants were effective at the time?
ActivityWhat do the target resource’s own audit logs show?
AttributionCan an approved workload, deployment or operator explain the activity?
ContainmentWhat business process would break if the credential were disabled?
Reconstruct the directory change timeline
Directory audit events may provide useful context around ownership, permissions and credentials. In this example, the team preserved all candidate events, then correlated their timestamps and object IDs with the sign-in records. A matching time window alone does not prove that a particular audit event caused a sign-in.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
// Microsoft Sentinel — requires Entra AuditLogs ingestion
let StartUtc = datetime(2026-10-19T00:00:00Z);
let EndUtc = datetime(2026-10-21T00:00:00Z);
AuditLogs
| where TimeGenerated between (StartUtc .. EndUtc)
| where Category =~ "ApplicationManagement"
| project TimeGenerated, OperationName, Result,
InitiatedBy, TargetResources, CorrelationId
| order by TimeGenerated ascThe investigation timeline
All events below are illustrative; the times are UTC and do not represent a real GEMXIT customer incident.
19 Oct, 01:12 UTC — AuthenticationThe unfamiliar service principal records a successful sign-in to a Microsoft resource.
19 Oct, 01:18 UTC — Access reviewThe SOC flags the identity because no owner or approved integration is documented.
19 Oct, 02:05 UTC — Credential reviewA valid certificate credential is found; its private-key custodian remains unknown.
19 Oct, 02:40 UTC — Permissions reviewedApp role assignments are exported and compared with approved business requirements.
19 Oct, 03:25 UTC — Resource evidence checkedThe team searches available workload-specific audit logs for activity attributable to the app.
19 Oct, 04:10 UTC — Response agreedIdentity owners and incident responders approve proportionate containment and further review.
The finding: valid does not mean approved
In this fictional case, the team could not identify a current owner or authorised deployment for the application. Its successful certificate-based sign-in was verified, and the application had permissions that warranted scrutiny. However, the available evidence did not establish that sensitive data had been accessed or exfiltrated.
The organisation classified the workload identity as unapproved and potentially exposed, preserved sign-in and audit records, reviewed dependent services, and followed its change-controlled response process to disable or replace the credential where appropriate. The team also investigated where the private key had been stored and whether any legitimate automation depended on it.
The organisation classified the workload identity as unapproved and potentially exposed, preserved sign-in and audit records, reviewed dependent services, and followed its change-controlled response process to disable or replace the credential where appropriate. The team also investigated where the private key had been stored and whether any legitimate automation depended on it.
Practical defensive lessons
Maintain an inventory of application registrations and enterprise applications with named owners. Review certificate and secret expiry, storage and rotation. Restrict who can add credentials or grant high-impact permissions. Apply least privilege, monitor service principal sign-ins and application-management events, and ensure resource audit logs are retained where needed.
Evidence rule: A successful service principal sign-in establishes that Entra ID accepted an authentication attempt. It does not, by itself, establish human identity, business authorisation or downstream data access.
Evidence rule: A successful service principal sign-in establishes that Entra ID accepted an authentication attempt. It does not, by itself, establish human identity, business authorisation or downstream data access.
Final thought
“So the certificate was genuine?” the analyst asked.
“Yes,” Agent Foskett replied.
“And the sign-in succeeded?”
“Also yes.”
“Then what’s the problem?”
Agent Foskett looked at the application inventory. There was a long silence.
“Apparently, we have given a perfectly valid set of keys to a visitor nobody remembers inviting.”
He closed the case notes.
“The Logs Already Knew!” 🔎
“Yes,” Agent Foskett replied.
“And the sign-in succeeded?”
“Also yes.”
“Then what’s the problem?”
Agent Foskett looked at the application inventory. There was a long silence.
“Apparently, we have given a perfectly valid set of keys to a visitor nobody remembers inviting.”
He closed the case notes.
“The Logs Already Knew!” 🔎
Related investigations
At 3:21 AM, Someone Changed the Retention PolicyCorrelate privileged administrative changes with identity and audit evidence.The AI Assistant Answered a Question Nobody Should Have AskedInvestigate unexpected behaviour without treating suspicion as proof.Defender Detected the Threat — But the Response Action FailedVerify what security controls actually achieved.
