Temporary Access Pass Created by Service Principal
Detects the creation of a Temporary Access Pass (TAP) by a service principal or agent identity, rather than a human administrator. This scenario indicates a potential compromise where a Temporary Access Agent with UserAuthMethod-TAP.ReadWrite.All permission is abused to generate a TAP for a Global Administrator.
Microsoft Sentinel (KQL)
