ServicePrincipalAddedToRole [Nobelium]

One of the indicators of compromise for the Nobelium (formerly Solorigate) campaign was that unexpected service principals have been added to privileged roles. This query looks for service principals that have been added to any role. See Understanding "Solorigate"'s Identity IOCs - for Identity Vendors and their customers.. Reference - https://techcommunity.microsoft.com/t5/azure-active-directory-identity/understanding-quot-solorigate-quot-s-identity-iocs-for-identity/ba-p/2007610