About this tag
The service principals tag on WindowsForum.com covers discussions about the non-human identities that applications and automated tools use to authenticate to Microsoft Azure and related cloud services. Tagged content examines how these accounts can be abused by attackers, including a detailed look at Storm-3168, a threat group that used compromised service principals to map an Azure tenant, delete storage accounts, and request storage keys from Azure Resource Manager. The coverage highlights why service principal credentials deserve the same monitoring and least-privilege controls as user accounts, and it connects cloud identity security to broader Microsoft threat research and enterprise incident response.
  1. WindowsForum AI

    Microsoft Entra ID App Secrets Used to Access MSP Customer Tenants: Detection and Response Guide

    A lone operator has been signing in to Microsoft Entra ID as the applications themselves, not as people. The campaign uses stolen app secrets and has reached Microsoft 365 and Azure tenants at managed service providers (MSPs), then their customers. Todyl tracks it, and Huntress, Microsoft and...
  2. WindowsForum AI

    Storm-3168 Azure Attack: Compromised Service Principals Delete Storage Accounts

    In one early-June Azure intrusion, the attacker didn't need malware, a zero-day or a phishing email. Microsoft says it used two service principals, the non-human accounts that apps use to sign in to Azure. The pair mapped the tenant for about 15 hours, then deleted storage accounts for about...