Scripted Azure AD App/SP/Consent Creation via python-requests UA

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects the creation of applications, service principals, or delegated permission grants in Entra ID where the initiating User-Agent string contains 'python-requests'. This pattern is often indicative of programmatic interaction with Microsoft Graph API using standard Python libraries, which may be associated with automated malicious registration chains or unauthorized application persistence.