Agent Foskett Investigation • Microsoft Entra ID • Service Principal • AuditLogs • App Permissions • CloudAppEvents • KQL
The New Service Principal Had No Owner
The application identity had only existed for a few hours.
It had already been granted permissions.
It had already authenticated.
And it had already started touching cloud resources.
There was just one problem.
Nobody on the security team knew what it was for.
Nobody remembered approving it.
And when Agent Foskett checked the ownership information...
there was no owner.
Applications Are Identities Too
A service principal can access resources without a human signing in interactively. Investigate who created it, what permissions it received and what it actually did.
✓ Find the creation event
✓ Trace consent and permissions
✓ Follow subsequent application activity
The identity nobody recognised
Service principals are normal parts of Microsoft cloud environments. Applications, automation and integrations depend on them. That is exactly why an unexpected one deserves context rather than an automatic verdict. The investigation begins by establishing when the object appeared and who or what created it.
Recently createdThe object was new enough that its creation should still be visible in the audit trail.
No obvious ownerNo familiar team or administrator could immediately explain its business purpose.
Already activeThe application identity was not merely sitting unused. It had begun interacting with the tenant.
Find the service principal creation event
Microsoft Entra AuditLogs can show application and service-principal lifecycle activity. Start with creation-related operations and inspect the initiating identity and target resources rather than relying only on the current object configuration.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
AuditLogs
| where TimeGenerated > ago(7d)
| where Category == "ApplicationManagement"
| where OperationName has_any ("service principal", "application")
| where Result =~ "success"
| project TimeGenerated,
OperationName,
InitiatedBy,
TargetResources,
AdditionalDetails,
CorrelationId
| order by TimeGenerated descWho initiated the change?
The current owner field may be empty, but the audit event can still reveal the identity that created or modified the object. Extract the initiating user or application and use that entity as the next pivot.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
AuditLogs
| where TimeGenerated > ago(7d)
| where Category == "ApplicationManagement"
| extend InitiatingUser =
tostring(InitiatedBy.user.userPrincipalName),
InitiatingApp =
tostring(InitiatedBy.app.displayName)
| project TimeGenerated,
OperationName,
InitiatingUser,
InitiatingApp,
TargetResources,
Result
| order by TimeGenerated ascWhat permissions were granted?
Creation alone does not define risk. The next question is capability. Review consent and permission-grant events associated with the application identity. Broad Microsoft Graph or resource permissions can dramatically change the importance of an otherwise ordinary-looking service principal.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
AuditLogs
| where TimeGenerated > ago(7d)
| where Category == "ApplicationManagement"
| where OperationName has_any
("consent", "permission", "OAuth2PermissionGrant",
"app role assignment")
| project TimeGenerated,
OperationName,
InitiatedBy,
TargetResources,
ModifiedProperties = TargetResources[0].modifiedProperties,
Result
| order by TimeGenerated ascDid the service principal authenticate?
Where service-principal sign-in telemetry is available, review non-human authentication activity separately from normal user sign-ins. Look at the application ID, resource, IP address and result to establish whether the identity has already been used.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| project TimeGenerated,
ServicePrincipalName,
ServicePrincipalId,
AppId,
ResourceDisplayName,
IPAddress,
ResultType,
ResultDescription
| order by TimeGenerated descWhat did the application identity do next?
Authentication proves use, not impact. Pivot into cloud audit activity and look for actions attributable to the application or service principal. Depending on the connected services and available telemetry, this may reveal access to files, mail, administrative operations or other cloud resources.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
let AppId = "00000000-0000-0000-0000-000000000000";
CloudAppEvents
| where Timestamp > ago(7d)
| where tostring(RawEventData) has AppId
| project Timestamp,
Application,
ActionType,
AccountDisplayName,
IPAddress,
RawEventData
| order by Timestamp ascNo owner does not automatically mean malicious
Ownership is a governance signal, not a malware verdict. Legitimate service principals can be ownerless because of deployment practices, staff changes or poor lifecycle management. The investigation must distinguish an undocumented business application from persistence or unauthorised consent.
Legitimate but unmanagedThe application may have a valid purpose but weak ownership and lifecycle controls.
Unexpected integrationA user or administrator may have authorised an application without the security team knowing about it.
Potential persistenceAn attacker with sufficient access may create or abuse application identities to maintain access without relying on a normal user session.
Build the application identity timeline
Bring the evidence together chronologically: object creation, credential changes, consent, role or permission grants, service-principal sign-ins and subsequent cloud activity. The timeline should explain both how the identity gained capability and how that capability was used.
CreationWhen did the application identity first appear, and who initiated it?
CapabilityWhat permissions, roles, credentials or consent changed what the identity could do?
ActivityWhat resources did the service principal actually access after those changes?
Agent Foskett's investigation mindset
Human identities are only part of the tenant. Applications, managed identities and service principals can become powerful investigation entities because they may operate continuously without an interactive user sign-in.
Ask who created itThe creation event can reveal the human or application behind the object.
Ask what it can doPermissions and consent define the potential impact.
Ask what it didAuthentication and cloud activity define the actual impact.
Investigation findings
The missing owner was the clue, not the conclusion. By tracing application-management audit events, consent, permissions, service-principal authentication and cloud activity, the analyst could determine whether the object was legitimate but poorly governed, an unexpected integration, or an identity requiring immediate containment.
The object told only part of the storyCurrent configuration could not explain who created it or why.
The audit trail supplied the historyCreation and permission events reconstructed how the service principal gained access.
Activity established impactThe investigation continued until the team understood what the application identity had actually done.
Related Agent Foskett investigations
Continue with application consent, privilege and Microsoft Entra identity investigations.
The New MFA Method Was Registered 11 Minutes After the LoginFollow an identity change that alters the compromise story.
The Global Admin Role Was Active for Only 14 MinutesInvestigate temporary privilege by focusing on what happened while the access existed.
Agent Foskett AcademyBuild practical Microsoft security investigation and KQL skills.
Final thought
An ownerless service principal is not automatically an attacker. But an application identity with unexplained creation, powerful permissions and unexplained activity should never be dismissed simply because no human user is signing in. Find who created it. Find what it can do. Then find what it did.
Who created it?Start with the application-management audit trail.
What can it do?Review consent, roles, credentials and permissions.
What did it do?Follow authentication and cloud activity until the impact is understood.
