Azure AD Service Principal Enumeration or Brute Force

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

Detects anomalous authentication failure patterns against Azure AD Service Principals from a single IP address. The rule identifies potential brute force attacks (high volume of failures) or service principal enumeration (multiple distinct service principals targeted).