Hunting for Suspicious Entra Provisioning and Service Principal Changes

Identity platform flaws — and attackers who abuse provisioning — can create or modify accounts in ways that look automated. These detections focus on provisioning and service principal changes.

Signals worth watching

• Provisioning jobs creating or updating users outside normal schedules or volumes.
• Provisioning adding users to privileged groups.
• Changes to provisioning configuration (scope, attribute mappings, credentials).
• New credentials added to service principals involved in provisioning or synchronization.
• New service principals with directory write permissions.

Where the data lives

• Entra provisioning logs (AADProvisioningLogs in Log Analytics/Sentinel).
• Entra audit logs for configuration and credential changes.
• Service principal sign-in logs.

A starting query

Provisioning actions by volume and type:

AADProvisioningLogs
| summarize Actions = count() by ServicePrincipal = tostring(ServicePrincipal.Name), ProvisioningAction, bin(TimeGenerated, 1h)
| sort by Actions desc

Privileged group membership changes by apps:

AuditLogs
| where OperationName == "Add member to group"
| where isnotempty(tostring(InitiatedBy.app.displayName))
| extend Group = tostring(TargetResources[1].displayName)
| where Group has_any ("Admin", "Privileged", "Global", "Security")
| project TimeGenerated, InitiatedBy, Group, TargetResources

Adjust group name filters to your naming conventions, or use a watchlist of privileged groups.

Response

1. Pause the provisioning job if behavior is unexpected.
2. Reverse unauthorized changes.
3. Rotate provisioning credentials.
4. Review audit logs for related changes.