Investigate the source of the incident: Determine the source of the incident by identifying the user or application that created the service principal.

Check for any signs of unauthorized access: Look for any signs of unauthorized access or suspicious activity, such as excessive or unusual resource usage, failed login attempts, or changes to resource configurations.Check the role assignments and access policies to confirm that the service principal has been granted the necessary permissions to access the resource. Review access permissions: Review the access permissions granted to the service principal to ensure they are appropriate and aligned with your organization's security policies.Verify the service principal's name, application ID, and other details to ensure they match those of a trusted application or service. Verify the identity of the service principal: Ensure that the service principal is a legitimate identity authorized to access the resource.

Review the logs to identify the specific service principal and the resource it accessed. Review Azure Activity Logs: Azure Activity Logs provide a record of all operations performed on Azure resources, including access by service principals.Investigation įollow the below steps to investigate the incident: If an unauthorized party gains access to a service principal, they could use it to access sensitive data or perform unauthorized actions. A new service principal (SP) accessing a resource may be an indication of a potential security breach. Why this Alert is Important Īs an Azure administrator, you want to ensure this new user is a valid member of your organization and has the permission to perform this action.

This alert occurs when Lacework detects a new Azure user has used an API to access resources for the first time.

Risky sign in azure ad