Microsoft Entra service-principal sign-ins

Source and collection

Product audit API or configured diagnostic export.

Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 570e7ee54145cdd28b82796681d3c42c5cbe14c6be7878c6efa6b732593e91a3

{"callerIpAddress":"0.0.0.0","category":"ServicePrincipalSignInLogs","correlationId":"11111111-1111-1111-1111-111111111111","durationMs":"0","level":"Informational","location":"AU","operationName":"Sign-in activity","operationVersion":"1.0","properties":{"alternateSignInName":"","appDisplayName":"Placeholder Application Name","appId":"22222222-2222-2222-2222-222222222222","appServicePrincipalId":null,"appliedConditionalAccessPolicies":[],"authenticationContextClassReferences":[],"authenticationDetails":[],"authenticationProcessingDetails":[{"key":"Azure AD App Authentication Library","value":"Family: MSAL Library: MSAL.NET 4.54.1.0 Platform: .NET FW"},{"key":"Legacy TLS (TLS 1.0, 1.1, 3DES)","value":"False"},{"key":"Is Legacy Store Used","value":"False"},{"key":"Is CAE Token","value":"True"}],"authenticationProtocol":"none","authenticationRequirement":"","authenticationRequirementPolicies":[],"autonomousSystemNumber":7545,"clientAppUsed":"Unknown","conditionalAccessStatus":"notApplied","correlationId":"11111111-1111-1111-1111-111111111111","createdDateTime":"2025-11-14T01:46:16.4282975+00:00","crossTenantAccessType":"none","deviceDetail":{"browser":"Whatever Client 4.54.1.0","deviceId":"55555555-5555-5555-5555-555555555555","displayName":"DevicePlaceholder","isManaged":false,"operatingSystem":"Windows10","trustType":"Azure AD registered"},"flaggedForReview":false,"globalSecureAccessIpAddress":"","homeTenantId":"","homeTenantName":"","id":"66666666-6666-6666-6666-666666666666","incomingTokenType":"none","ipAddress":"0.0.0.0","ipAddressFromResourceProvider":"","isInteractive":false,"isTenantRestricted":false,"location":{"city":"Placeholder City","countryOrRegion":"ZZ","geoCoordinates":{"latitude":-0.000000,"longitude":0.000000},"state":"Placeholder State"},"networkLocationDetails":[{"networkNames":["PlaceholderNetwork1"],"networkType":"namedNetwork"},{"networkNames":["PlaceholderNetwork2"],"networkType":"trustedNamedLocation"}],"originalRequestId":"66666666-6666-6666-6666-666666666666","privateLinkDetails":{},"processingTimeInMilliseconds":49,"redirectUrl":"","resourceDisplayName":"MDATPNetworkScanAgent","resourceId":"44444444-4444-4444-4444-444444444444","resourceTenantId":"33333333-3333-3333-3333-333333333333","riskDetail":"none","riskEventTypes":[],"riskEventTypes_v2":[],"riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","servicePrincipalCredentialKeyId":"","servicePrincipalCredentialThumbprint":"","servicePrincipalId":"99999999-9999-9999-9999-999999999999","sessionLifetimePolicies":[],"signInIdentifier":"","sourceAppClientId":"","status":{"errorCode":0},"tokenIssuerName":"","tokenIssuerType":"AzureAD","uniqueTokenIdentifier":"mmmmmmmmmmmmmmmmm","userAgent":"","userDisplayName":"","userId":"","userPrincipalName":"","userType":"Member"},"resourceId":"/tenants/33333333-3333-3333-3333-333333333333/providers/Microsoft.aadiam","resultSignature":"SUCCESS","resultType":"0","tenantId":"33333333-3333-3333-3333-333333333333","time":"11/14/2025 1:48:53 AM"}

Structure and field interpretation

Event identity

Use the source event ID and tenant scope to deduplicate.

Event type

Select the schema for this category/action.

Timestamp

Retain both event and ingestion time where available.

Investigation uses

• Review application identity, resource, IP and result with credential changes.
• Compare actor and target context with approved changes and other authentication evidence.

Validation boundaries

This category is not interactive user sign-in; result fields and export envelopes differ.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 4720 — User account created
• Windows Security 4732 — Member added to local security group
• Microsoft Entra directory audit
• Okta System Log
• Google Workspace login audit
• Google Workspace administrator audit

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• Learn about the monitoring and health activity log schemas - Microsoft Entra ID | Microsoft Learn

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.