Service Principal creation audit logs for alerting & monitoring
New audit log properties now make it easy for admins to understand why a service principal was created and who or what triggered it. The logs now surface the provisioning mechanism, the specific SKUs or service plans that enabled just‑in‑time creation, and the home tenant of the app registration. This helps admins quickly distinguish Microsoft‑driven provisioning from tenant‑driven activity, streamlining alerting and investigations into newly created service principals. For more information, see:
Terms in this update
- Audit logThe audit log records the activities of users and administrators in Microsoft 365, such as opening or sharing…
- Service principalA service principal is the local representation of an application in a Microsoft Entra tenant. The app's permissions,…
- TenantA tenant is an organisation's own, isolated environment within Microsoft 365 and Microsoft Entra ID. All of the…
- App registrationAn app registration records in Microsoft Entra ID that an application or script may sign in and which…
This is in the weekly digest for week 40 · What changed this week? →
More Entra updates
BYOD support for Windows client using Entra registration
Domainless SAML IdP federation for workforce tenants
Extended Conditional Access protections for Agent's user accounts
External users can be directly assigned to Access Packages
Improved restore experience for device-bound Authenticator app passkeys on iOS
Jailbreak/Root Detection in Authenticator App
Text by Microsoft, from Microsoft's documentation. Features and dates may change. Terms and the timeline are added by 365Fanatic.
