Azure AD Service Principal Enumeration

This detection leverages Azure Graph activity logs to identify when Graph APIs have been used to identify 10 or more service principals. This type of behavior is associated with tools such as Azure enumeration tools like AzureHound or ROADtools.