Azure Entra: Service Principal Secret Failure Followed by Success from a New IP

Awais Munir@iawais

•updated yesterday•14•1•21

Someone holding a stolen secret often tries the wrong value first, then the right one. Todyl (intel) observed an invalid secret (7000215) followed within minutes by a success for the same app from the same IP. This rule finds that pattern, but only where the app has never succeeded from that IP in the previous 30 days, which removes routine automation. It doesn’t depend on any indicator, so it survives infrastructure changes.