Service Principal Acting on Other Applications
One service principal modifying another service principal’s configuration - credential additions, owner changes, permission grants. This is the cross-application pivot pattern. In a healthy environment, this should be extremely rare.
Microsoft Sentinel (KQL)
