Azure AD Federated Identity Credential Added To Service Principal

The following analytic detects additions of federated identity credentials to Entra ID service principals. It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty. Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret. If an attacker adds a federated credential pointing to a controlled OIDC issuer, they gain a persistent secretless authentication path into the SP that survives credential rotations and is not visible in standard secrets monitoring.