AADServicePrincipalSignInLogs

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for AADServicePrincipalSignInLogs table in Azure Monitor Logs.

Attribute	Value
Category	Entra
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes (source)
Azure Monitor Tables Reference	View Documentation

Schema
Schema References
Solutions
Connectors
Content Items
Parsers

Schema (46 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
AADTenantId	string	ID of the AAD tenant.
Agent	string	Details of agentic sign-in.
AppId	string	Unique GUID representing the app ID in the Microsoft Entra ID
AppOwnerTenantId	string	The tenant identifier of the owenr of the application in Microsoft Entra ID
AuthenticationContextClassReferences	string	The authentication contexts of the sign-in
AuthenticationProcessingDetails	string	Provides the details associated with authentication processor
AutonomousSystemNumber	string	Autonomous System Number for the network.
Category	string	Category of the sign-in event
ClientCredentialType	string	The type of client credential used. Examples include client assertion, client secret, etc.
ConditionalAccessAudiences	string	Details of the conditional access audiences being applied for the sign-in.
ConditionalAccessPolicies	string	Details of the conditional access policies being applied for the sign-in
ConditionalAccessStatus	string	Status of all the conditionalAccess policies related to the sign-in
CorrelationId	string	ID to provide sign-in trail
CreatedDateTime	datetime	Datetime of the sign-in activity.
DurationMs	long	The duration of the operation in milliseconds
FederatedCredentialId	string	Th identifier of an application's federated identity credential if a federated identity credential was used to sign in.
Id	string	Unique ID representing the sign-in activity
Identity	string	The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal
IPAddress	string	IP address of the client used to sign in
Level	string	The severity level of the event
Location	string	The region of the resource emitting the event
LocationDetails	string	Details of the sign-in location
NetworkLocationDetails	string	Provides the details associated with Authentication processor.
OperationName	string	For sign-ins, this value is always Sign-in activity
OperationVersion	string	The REST API version that's requested by the client
ResourceDisplayName	string	Name of the resource that the service principal signed into
ResourceGroup	string	Resource group for the logs
ResourceIdentity	string	ID of the resource that the service principal signed into
ResourceOwnerTenantId	string	The tenant identifier of the owner of the resource referenced in the sign in
ResourceServicePrincipalId	string	Service Principal Id of the resource
ResultDescription	string	Provides the error description for the sign-in operation
ResultSignature	string	Contains the error code, if any, for the sign-in operation
ResultType	string	The result of the sign-in operation can be Success or Failure
ServicePrincipalCredentialKeyId	string	Key id of the service principal that initiated the sign-in
ServicePrincipalCredentialThumbprint	string	Thumbprint of the service principal that initiated the sign-in
ServicePrincipalId	string	ID of the service principal who initiated the sign-in
ServicePrincipalName	string	Service Principal Name of the service principal who initiated the sign-in
SessionId	string	Id of the session that was generated during the signIn.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The date and time of the event in UTC
Type	string	The name of the table
UniqueTokenIdentifier	string	Unique token identifier for the request
UserAgent	string	User Agent for the sign-in

Schema References

Official Microsoft Learn documentation for field/column information:

AADServicePrincipalSignInLogs Schema Reference (Azure Monitor)

Solutions (8)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Entra ID

Content Items Using This Table (23)

Analytic Rules (4)

In solution Lumen Defender Threat Feed:

Analytic Rule	Selection Criteria
Lumen TI IPAddress in IdentityLogonEvents

In solution Microsoft Entra ID:

Analytic Rule	Selection Criteria
Suspicious Service Principal creation activity

In solution StratoSecure:

Analytic Rule	Selection Criteria
Secret Exposure with Anomalous SPN Sign-In

Standalone Content: ResultType != "50126"

Analytic Rule
Service Principal Authentication Attempt from New Country

Hunting Queries (9)

In solution Hybrid Attack - Cloud & Identity:

Hunting Query	Selection Criteria
Key Vault harvest to SPN sign-in then out-of-scope resource access
Key Vault secret harvest followed by novel SPN sign-in from non-1P IP
Novel SPN sign-in followed by Azure RBAC write
Novel identity then Key Vault secret burst
Secret Added to Dormant Service Principal
Service principal Conditional Access anomaly	`ConditionalAccessStatus in "failure,notApplied"` `ResultType in "0,Success"`
Service principal credential change followed by novel SP sign-in

Standalone Content: ResultType == "0"

Hunting Query
Workload identity sign-in from a country not in 14-day baseline

GitHub Only:

Hunting Query	Selection Criteria
Dormant Service Principal Update Creds and Logs In

Workbooks (10)

In solution AzureSecurityBenchmark:

Workbook	Selection Criteria
AzureSecurityBenchmark

In solution CybersecurityMaturityModelCertification(CMMC)2.0:

Workbook	Selection Criteria
CybersecurityMaturityModelCertification_CMMCV2