Narada Notification Service in audit log

Question

I have a strange entry in the Entra ID audit.log: -The entry does not have an "actor" specified -the message says that somebody (Narada Notification Service) installed successfully a Service Principal NaradaAuditLogDetails.png Google knows some similar cases but Microsoft did not answer it?

Answer 1

@cb Thank you for reaching out to us, As I understand you are looking for details on Narada Notification Service in Entra ID audit logs.

I have checked internally on this, this app is first party app, which is created by Microsoft.

For more details on this app, would request you to open a support ticket with us, so that our team can investigate this further. Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Thank you for this information, which seems to relate not only to UNeedSecurity but other customers as well. The reason, you mentioned "in order for the users to receive Microsoft emails" raises further questions: we got Microsoft emails previously- so what kind of additional emails do we get thanks to this new Service Principal? Looking at the grants, that the "Narada Application Service" Enterprise Application has: "Cloud Application Administrator" and "Reports Reader" roles. What exactly are you going to do with them? Please understand, we are a security company, we can't have there some undocumented leaks within our infrastructure. At the first step, I configured an "Role assignment alert" to the admin, in order to get involved, when these roles are assigned. But as the service principal got installed without asking us, will this alert be effective? Thank you for your time.

Answer 3

We also had this SPN randomly install itself in December 2023 under identical circumstances. @Givary-MSFT Is there somewhere security/auditors/and other Azure/Entra ID professionals can get updates on when/if Microsoft will be pushing 1st party service principals to our environments? Unfortunately this is not the first, second, or even 3rd time we've had a previously unknown 1st party Service Principal get installed in our environment without any warning. It would be nice if we could get some more visibility either from the audit log directly or advance notice of these changes. Thank you for your time.