Anomalous Service Principal Authentication

Daniel Koifman@Koifsec

•updated Mar 1, 2026•16•0•100

A service principal authenticating from an IP address it has never used in the past 14 days - the strongest signal of credential theft for NHIs, equivalent to “impossible travel” for human identities.