Monitoring Service principal sign-ins with AzureAD and Azure Sentinel

Sat, 10 Oct 2020 14:14:12 +0000

Here is a conversation between Jeffrey (Developer) and Marc (IT Admin) working for ECorp Ltd.

Looks familiar? Take a look in your Azure Active directory, how many applications do you have there? In an ideal world you maintain an inventory of all these applications somewhere in your asset management database so that you know who is the owner of the Application and what it is used for and what API permissions are granted. As for the client secret, this should be stored in a Vault.

Azuresentinel on Anything About IT

Monitoring Service principal sign-ins with AzureAD and Azure Sentinel