Sunturai
Back to results
MediumSplunk security contentdescambiado +2

Azure AD Federated Identity Credential Added To Service Principal

The following analytic detects additions of federated identity credentials to Entra ID service principals. It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application"…

Description

The following analytic detects additions of federated identity credentials to Entra ID service principals. It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty. Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret. If an attacker adds a federated credential pointing to a controlled OIDC issuer, they gain a persistent secretless authentication path into the SP that survives credential rotations and is not visible in standard secrets monitoring.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuitePRESaaS

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
azure_active_directory

Known benign triggers

  • Platform engineers legitimately configure federated credentials when setting up GitHub Actions OIDC federation, Kubernetes Workload Identity, or other secretless CI/CD patterns. Validate the actor, the target SP, and whether the issuer in newCreds corresponds to a known trusted OIDC provider. Unknown issuers or overly permissive subject claims in the newCreds JSON warrant immediate investigation.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice