Service Principal Credential Addition

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•6

Detects attempts to add credentials or secrets to a service principal to establish persistence independent of user accounts. This rule specifically looks for 'Add service principal credentials' or 'Update application - Certificates and secrets management' operations in Azure AuditLogs.