Dormant OAuth app suddenly reactivating

Ankit Mehta@Secvyn

•updated Aug 8, 2026•1•0•9

This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.