Need to know who created an object in O365 Audit logs shows user as "Service Principle" User object created was :

Kit Sarsoza 1

Need to know who created an object in O365
Audit logs shows user as "Service Principal"
User object created was :

from this article : http://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals#:~:text=A%20service%20principal%20is%20created%20in%20each%20tenant%20where%20the,resources%20the%20app%20can%20access.

This article describes application registration, application objects, and service principals in Azure Active Directory (Azure AD): what they are, how they're used, and how they are related to each other. A multi-tenant example scenario is also presented to illustrate the relationship between an application's application object and corresponding service principal objects.

Follow-up question : How do we know which application was accessed and by whom?
And how can accessing a application create a user object?

Givary-MSFT 30,931 Reputation points Microsoft Employee

2022-04-18T09:22:02.503+00:00

@Kit Sarsoza Apologies for the delay in answering this post. As I understand you are looking for information on object creation in O365.

In Azure AD, a resource access has three relevant components:

Who – The identity (User) doing the sign-in.
How – The client (Application) used for the access.
What – The target (Resource) accessed by the identity.

The Sign-ins report includes all user sign-ins, as well as the Application Usage report. You also can view application usage information in the Manage section of the Enterprise applications overview.
Reference: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-find-activity-reports#sign-ins-report
Azure AD security operations guide: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications
Azure AD Activity Reference:
https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-basic-info-sign-in-logs
Givary-MSFT 30,931 Reputation points Microsoft Employee

2022-04-18T09:22:34.317+00:00

@Kit Sarsoza

To answer this how can accessing a application create a user object? -

Are you using self signup feature with Azure AD ? if so they while accessing app user profile would be created by using user sign in flow in B2C external identity feature.

With multi tenant app , the service principal would be created while user access app , they can see all multi-tenant apps under enterprise app blade in azure AD when they click each , the SSO setting page would show regular or multi tenant app.

If this doesnt answer your query, let me know we can connect offline and discuss further on the same.

Share via

Need to know who created an object in O365 Audit logs shows user as "Service Principle" User object created was :