Credential Addition to Application or Service Principal

Daniel Koifman@Koifsec

•updated Mar 1, 2026•8•0•64

Any credential addition to an application registration or service principal, distinguishing whether the actor was a human user or another service principal. When InitiatedByType == "ServicePrincipal", the alert severity should be critical - service principals adding credentials to other service principals is the hallmark of automated persistence.