LoFP / service principal being removed may be performed by a system administrator.

Techniques

Sample rules

Azure Service Principal Removed

• source: sigma
• technicques:

Description

Identifies when a service principal was removed in Azure.

Detection logic

condition: selection
selection:
  properties.message: Remove service principal