Lesson 155 — The Application Accessed Data Without the User

Case briefing

Stage 1 — find the application's service principal sign-ins

Pivot from the application identifier discovered in Lesson 154 into AADServicePrincipalSignInLogs. Preserve the application, resource, source IP, location, result and correlation context.

let TargetAppId = "11111111-2222-3333-4444-555555555555";
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where AppId == TargetAppId
| project TimeGenerated,
          ServicePrincipalName,
          ServicePrincipalId,
          AppId,
          ResourceDisplayName,
          ResourceServicePrincipalId,
          IPAddress,
          Location,
          ResultType,
          ResultDescription,
          CorrelationId
| order by TimeGenerated asc

Stage 2 — summarise what the application accessed

Group service principal sign-ins by resource and result. This quickly shows how often the application authenticated, when it first and last appeared and which sources were involved.

let TargetAppId = "11111111-2222-3333-4444-555555555555";
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where AppId == TargetAppId
| summarize SignIns=count(),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            SourceIPs=make_set(IPAddress, 50),
            Locations=make_set(Location, 20)
          by ServicePrincipalName,
             ResourceDisplayName,
             ResultType
| order by SignIns desc

Stage 3 — search Microsoft 365 activity for application context

Now inspect Microsoft 365 audit activity for evidence that can be associated with the application. The exact fields exposed for app-only or service activity vary, so validate the schema and actor fields in your tenant.

let TargetAppId = "11111111-2222-3333-4444-555555555555";
let TargetAppName = "Contoso Document Helper";
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload in ("SharePoint", "OneDrive")
| extend ActorContext = strcat(
      tostring(UserId), " ",
      tostring(UserKey), " ",
      tostring(UserAgent), " ",
      tostring(ClientIP))
| where ActorContext has TargetAppId
   or ActorContext has TargetAppName
| project TimeGenerated,
          OfficeWorkload,
          Operation,
          UserId,
          UserKey,
          Site_Url,
          SourceFileName,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Stage 4 — test whether the user was actually active

Query interactive sign-in telemetry for the user during the same window. The absence of a matching user sign-in can support the conclusion that application activity occurred independently, but absence must be interpreted carefully.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 14:30:00);
let EndTime = datetime(2026-08-18 15:30:00);
SigninLogs
| where TimeGenerated between (StartTime .. EndTime)
| where UserPrincipalName =~ TargetUser
| project TimeGenerated,
          UserPrincipalName,
          AppDisplayName,
          IPAddress,
          Location,
          ClientAppUsed,
          ResultType
| order by TimeGenerated asc

Stage 5 — build the application-access timeline

Bring service principal authentication and Microsoft 365 workload activity into one chronological view. Use the timeline to test whether application access begins after consent and continues independently of the user's interactive activity.

let TargetAppId = "11111111-2222-3333-4444-555555555555";
let StartTime = datetime(2026-08-18 14:30:00);
let EndTime = datetime(2026-08-18 16:00:00);
union
(
    AADServicePrincipalSignInLogs
    | where TimeGenerated between (StartTime .. EndTime)
    | where AppId == TargetAppId
    | project TimeGenerated,
              EvidenceType="Service principal sign-in",
              Actor=ServicePrincipalName,
              Target=ResourceDisplayName,
              Source=IPAddress,
              Detail=strcat("Result=", tostring(ResultType))
),
(
    OfficeActivity
    | where TimeGenerated between (StartTime .. EndTime)
    | where OfficeWorkload in ("SharePoint", "OneDrive")
    | project TimeGenerated,
              EvidenceType="Microsoft 365 activity",
              Actor=tostring(UserId),
              Target=Site_Url,
              Source=ClientIP,
              Detail=strcat(Operation, " | ", SourceFileName)
)
| order by TimeGenerated asc

Agent Foskett's application-access timeline

Your evidence board

Write the finding like an investigator

Example: Following the OAuth consent event identified in Lesson 154, Microsoft Entra service principal sign-in telemetry recorded successful non-interactive authentication by the associated application to Microsoft 365 resources. The application was tracked using its application identifier and reviewed by target resource, source IP, location, result and time. Microsoft 365 workload audit activity was then examined for corresponding application context, while the target user's interactive sign-in activity was reviewed separately. The sequence supports the conclusion that the application exercised granted access after consent and was capable of operating without a new interactive user sign-in. The evidence should not be overstated: service principal authentication alone does not prove which organisational data was accessed or whether data was exfiltrated. Workload-level activity and permission scope should be used to determine actual impact.

Lesson 155 key takeaways

• Use AADServicePrincipalSignInLogs to investigate non-interactive application authentication.
• Track applications by stable identifiers rather than display name alone.
• Identify the resources targeted by the service principal.
• A successful application sign-in does not by itself prove specific data access.
• Correlate identity telemetry with workload-level audit activity.
• Validate how application identity is represented in your Microsoft 365 audit schema.
• No new interactive user sign-in does not prove that no existing user session existed.
• Explicit service principal identity is stronger evidence of app-driven activity.
• Repeated unauthorised app authentication can strengthen a cloud-persistence finding.
• Separate authentication, resource access and exfiltration into distinct evidence questions.

Module 13 — the investigation moves into the mailbox

Lesson 154 found the consent grant. Lesson 155 shows how to test whether the application exercised that access. Next, the cloud investigation pivots into Exchange Online, where a new inbox rule appears after the suspicious sign-in.