I need an explanation and more details on why this alert has been triggered "Add service principal credentials".

Question

Recently the alert "Add service principal credentials" has been triggered, But me and my team has did no changes in the Translator service. Can any one clarify why this alert has been generated and how to check for the fix.

Answer 1

Hello Kamala !

Thank you for posting on Microsoft Learn.

You are dealing with an alert which is a detection to catch potentially unauthorized or suspicious changes to service principals (which are often targets in attacks.)

When does the alert get triggered ? :

• A new client secret or certificate is added to a service principal
• Even automated or background processes (like credential rotation scripts or CI/CD pipelines) that add credentials will trigger this

Since you said that you don't have any manual changes made by your team, so my assumptions are:

• Automated credential rotation (via Azure Key Vault or security best-practice policies)
• A third-party app or script registered in Azure with delegated permissions that updated the credentials.
• A Managed Identity linked to the Translator service might be updating itself depending on configuration.

I recommend that you use Microsoft Defender for Identity or Defender for Cloud Apps to create custom detections for unusual app behavior.