Hi CarlosJ
We understand your concern. While you are able to view sign-in logs for the Service Principal, it's important to note that the MicrosoftServicePrincipalSignInLogs primarily capture authentication events, and not the detailed API call activities you might be expecting. These logs are designed to provide visibility into service-to-service authentication rather than ongoing operational activity.
Additionally, please be aware that the MicrosoftServicePrincipalSignInLogs are currently in preview and may not be fully available across all tenants or regions. This could contribute to the absence of expected logs.
To monitor API activity more comprehensively, we recommend the following steps:
Ensure that diagnostic settings are configured for relevant Azure resources (e.g., Azure Resource Graph, Azure Monitor). These settings are not enabled by default and are necessary to collect and route logs to Log Analytics, Event Hubs, or a storage account.
Explore Azure Activity Logs and resource-specific logs for potential traces of API interactions initiated by the Service Principal.
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-service-principal-sign-ins
Kindly let us know if the above helps or you need further assistance on this issue.
Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.