Service principal password reset, license assignment and role grant in M365 tena
Detects a service principal (app-only actor) performing a sequence of administrative actions including a password reset followed by license assignments and/or privileged role/permission grants within Azure Active Directory.
Splunk (SPL)

