Data Source: Azure Active Directory Add app role assignment to service principal

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 8b2e84cd-6db0-47e9-badc-75c17df1995f

Author: Patrick Bareiss, Splunk

Description

Logs the addition of an application role assignment to a service principal in Azure Active Directory, including details about the role, service principal, and the user or process performing the action.

Details

Property	Value
Source	`Azure AD`
Sourcetype	`azure:monitor:aad`
Separator	operationName

Name ▲▼	Technique ▲▼	Type ▲▼
Azure AD Admin Consent Bypassed by Service Principal	Additional Cloud Roles	TTP
Azure AD Service Principal Privilege Escalation	Additional Cloud Roles	TTP

Supported Apps

Splunk Add-on for Microsoft Cloud Services (version 6.3.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">additional_details</span>
  
  <span class="pill kill-chain">additional_details_name</span>
  
  <span class="pill kill-chain">additional_details_value</span>
  
  <span class="pill kill-chain">category</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">correlationId</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_type</span>
  
  <span class="pill kill-chain">durationMs</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">identity</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">object_attrs</span>
  
  <span class="pill kill-chain">object_id</span>
  
  <span class="pill kill-chain">operationName</span>
  
  <span class="pill kill-chain">operationVersion</span>
  
  <span class="pill kill-chain">path_from_resourceId</span>
  
  <span class="pill kill-chain">properties.activityDateTime</span>
  
  <span class="pill kill-chain">properties.activityDisplayName</span>
  
  <span class="pill kill-chain">properties.additionalDetails{}.key</span>
  
  <span class="pill kill-chain">properties.additionalDetails{}.value</span>
  
  <span class="pill kill-chain">properties.category</span>
  
  <span class="pill kill-chain">properties.correlationId</span>
  
  <span class="pill kill-chain">properties.id</span>
  
  <span class="pill kill-chain">properties.identity</span>
  
  <span class="pill kill-chain">properties.initiatedBy.app.appId</span>
  
  <span class="pill kill-chain">properties.initiatedBy.app.displayName</span>
  
  <span class="pill kill-chain">properties.initiatedBy.app.servicePrincipalId</span>
  
  <span class="pill kill-chain">properties.initiatedBy.app.servicePrincipalName</span>
  
  <span class="pill kill-chain">properties.loggedByService</span>
  
  <span class="pill kill-chain">properties.operationName</span>
  
  <span class="pill kill-chain">properties.operationType</span>
  
  <span class="pill kill-chain">properties.result</span>
  
  <span class="pill kill-chain">properties.resultDescription</span>
  
  <span class="pill kill-chain">properties.resultReason</span>
  
  <span class="pill kill-chain">properties.resultType</span>
  
  <span class="pill kill-chain">properties.targetResources{}.displayName</span>
  
  <span class="pill kill-chain">properties.targetResources{}.id</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.displayName</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.newValue</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.oldValue</span>
  
  <span class="pill kill-chain">properties.targetResources{}.type</span>
  
  <span class="pill kill-chain">properties.tenantGeo</span>
  
  <span class="pill kill-chain">properties.tenantId</span>
  
  <span class="pill kill-chain">properties.userAgent</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">resourceId</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">result_id</span>
  
  <span class="pill kill-chain">resultSignature</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_user_type</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tenantId</span>
  
  <span class="pill kill-chain">time</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user_agent</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1{"time": "2024-04-30T08:22:50.3424145Z", "resourceId": "/tenants/225e05a1-5914-4688-a404-7030e60f3143/providers/Microsoft.aadiam", "operationName": "Add app role assignment to service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultSignature": "None", "durationMs": 0, "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "identity": "MashAuthTest", "Level": 4, "properties": {"tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultType": "", "resultDescription": "", "operationName": "Add app role assignment to service principal", "identity": "MashAuthTest", "tenantGeo": "NA", "id": "Directory_c967e3a4-9afd-49ee-a68c-bc465aaef2b3_R6D6O_2613065", "category": "ApplicationManagement", "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "result": "success", "resultReason": "", "activityDisplayName": "Add app role assignment to service principal", "activityDateTime": "2024-04-30T08:22:50.3424145+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "MashAuthTest", "servicePrincipalId": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "servicePrincipalName": null}}, "targetResources": [{"id": "58c0347e-8f51-49e5-a4db-8b1b857a7ddf", "displayName": "Microsoft Graph", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AppRole.Id", "oldValue": null, "newValue": "\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\""}, {"displayName": "AppRole.Value", "oldValue": null, "newValue": "\"RoleManagement.ReadWrite.Directory\""}, {"displayName": "AppRole.DisplayName", "oldValue": null, "newValue": "\"Read and write all directory RBAC settings\""}, {"displayName": "AppRoleAssignment.CreatedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "AppRoleAssignment.LastModifiedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "ServicePrincipal.ObjectID", "oldValue": null, "newValue": "\"ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66\""}, {"displayName": "ServicePrincipal.DisplayName", "oldValue": null, "newValue": "\"MashAuthTest\""}, {"displayName": "ServicePrincipal.AppId", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "ServicePrincipal.Name", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"https://canary.graph.microsoft.com/;https://graph.microsoft.us/;https://dod-graph.microsoft.us/;https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000\""}], "administrativeUnits": []}, {"id": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "displayName": "7889f28d-ad42-441e-b1f6-1ad8da2f13e8", "type": "ServicePrincipal", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19045; en-AU) PowerShell/5.1.19041.4291"}, {"key": "AppId", "value": "00000003-0000-0000-c000-000000000000"}]}}

Required Output Fields

dest
user
src
vendor_account
vendor_product

Source: GitHub | Version: 4