Sigma rule: Azure Service Principal Removed

Rule

Title

Azure Service Principal Removed

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-09-03

Modified

2026-04-30

File

rules/cloud/azure/audit_logs/azure_service_principal_removed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when a service principal was removed in Azure.

Log source

product

azure

service

auditlogs

Detection

selection:
    operationName: 'Remove service principal'
condition: selection

False positives (as the rule lists them)

• Service principal being removed may be performed by a system administrator.
• Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.stealth

References

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
• https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/audit_logs/azure_service_principal_removed.yml