Entra ID Application Client Secret Activity

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•0•44

This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.