{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "Level": 4, "properties": {"id": "Directory_ea473f15-64b3-435a-a885-6ee3908919e2_GSOLK_21152854", "category": "ApplicationManagement", "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:14.4970418+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "2dedf863-ac93-4f45-87b3-e32f48145380", "displayName": "Malicious11", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e06366ca-8489-4748-b6a2-d7e4332f45c1\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}}
{"time": "2024-02-07T22:31:14.1391226Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "9a0d48df-8083-4c2a-9095-5475289fb512", "Level": 4, "properties": {"id": "Directory_9a0d48df-8083-4c2a-9095-5475289fb512_B431O_22427959", "category": "ApplicationManagement", "correlationId": "9a0d48df-8083-4c2a-9095-5475289fb512", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:31:14.1391226+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "aef7a9a6-428e-4f0f-ab09-b0f10b21bda6", "displayName": "Malicious11", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}}
{"time": "2024-02-07T22:31:08.7435000Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "9ac984a7-4ce8-47c0-8e1b-0813d688163a", "Level": 4, "properties": {"id": "Directory_9ac984a7-4ce8-47c0-8e1b-0813d688163a_BLGGV_23593923", "category": "ApplicationManagement", "correlationId": "9ac984a7-4ce8-47c0-8e1b-0813d688163a", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:08.7435+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "e1ed4567-2dcb-4f69-b9e0-b90d777e1ef7", "displayName": "Malicious10", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"6afcdaf6-7dc9-43d2-a707-4274d499e479\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious10\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"6afcdaf6-7dc9-43d2-a707-4274d499e479\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"6afcdaf6-7dc9-43d2-a707-4274d499e479\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "6afcdaf6-7dc9-43d2-a707-4274d499e479"}]}}
{"time": "2024-02-07T22:31:08.4346466Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ae72115d-6d1e-4a44-a45b-428b899feaa6", "Level": 4, "properties": {"id": "Directory_ae72115d-6d1e-4a44-a45b-428b899feaa6_YVNJ7_25387365", "category": "ApplicationManagement", "correlationId": "ae72115d-6d1e-4a44-a45b-428b899feaa6", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:31:08.4346466+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "852b916a-d355-4991-82af-444a9f8e107f", "displayName": "Malicious10", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"6afcdaf6-7dc9-43d2-a707-4274d499e479\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious10\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "6afcdaf6-7dc9-43d2-a707-4274d499e479"}]}}
{"time": "2024-02-07T22:31:02.6673110Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "5e2f6daf-e67a-4df3-9b08-d5926464e4af", "Level": 4, "properties": {"id": "Directory_5e2f6daf-e67a-4df3-9b08-d5926464e4af_BLGGV_23593408", "category": "ApplicationManagement", "correlationId": "5e2f6daf-e67a-4df3-9b08-d5926464e4af", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:02.667311+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "bc4581c4-d67d-4d94-99fe-d3b05d0ccddd", "displayName": "Malicious9", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"c57490e5-d8bb-441d-a3b8-aa94b24d19cf\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious9\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"c57490e5-d8bb-441d-a3b8-aa94b24d19cf\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"c57490e5-d8bb-441d-a3b8-aa94b24d19cf\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "c57490e5-d8bb-441d-a3b8-aa94b24d19cf"}]}}
{"time": "2024-02-07T22:31:02.2266729Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ee0432fe-ffbb-49d7-822e-55ce39597c7a", "Level": 4, "properties": {"id": "Directory_ee0432fe-ffbb-49d7-822e-55ce39597c7a_YVNJ7_25386532", "category": "ApplicationManagement", "correlationId": "ee0432fe-ffbb-49d7-822e-55ce39597c7a", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:31:02.2266729+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "8294d9f8-20c4-4323-ad9f-e2d075f2ea2e", "displayName": "Malicious9", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"c57490e5-d8bb-441d-a3b8-aa94b24d19cf\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious9\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "c57490e5-d8bb-441d-a3b8-aa94b24d19cf"}]}}
{"time": "2024-02-07T22:30:53.6475802Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "b22b3d3e-b39f-4f30-bc62-f2a4b6cad7c6", "Level": 4, "properties": {"id": "Directory_b22b3d3e-b39f-4f30-bc62-f2a4b6cad7c6_I4C51_19036000", "category": "ApplicationManagement", "correlationId": "b22b3d3e-b39f-4f30-bc62-f2a4b6cad7c6", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:30:53.6475802+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "561a247c-98a8-46d0-8763-e79b8496c33f", "displayName": "Malicious8", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"0b4c428b-9287-44d4-9e60-b31e1a4c06db\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious8\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"0b4c428b-9287-44d4-9e60-b31e1a4c06db\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"0b4c428b-9287-44d4-9e60-b31e1a4c06db\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "0b4c428b-9287-44d4-9e60-b31e1a4c06db"}]}}
{"time": "2024-02-07T22:30:53.3175712Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "3f1217e2-8426-4672-b7cf-de25e664bc39", "Level": 4, "properties": {"id": "Directory_3f1217e2-8426-4672-b7cf-de25e664bc39_GSOLK_21149658", "category": "ApplicationManagement", "correlationId": "3f1217e2-8426-4672-b7cf-de25e664bc39", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:30:53.3175712+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "93bf46cf-43ae-4d3d-ac19-5cd68310569a", "displayName": "Malicious8", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"0b4c428b-9287-44d4-9e60-b31e1a4c06db\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious8\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "0b4c428b-9287-44d4-9e60-b31e1a4c06db"}]}}
{"time": "2024-02-07T22:30:45.1490729Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "dc672842-aa67-4f21-8a81-0f333672f89e", "Level": 4, "properties": {"id": "Directory_dc672842-aa67-4f21-8a81-0f333672f89e_B431O_22424263", "category": "ApplicationManagement", "correlationId": "dc672842-aa67-4f21-8a81-0f333672f89e", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:30:45.1490729+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "77db49cc-371e-4059-9a7b-88ee841b6518", "displayName": "Malicious7", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"52b89a79-1544-497e-9d64-169452efdb7b\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious7\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"52b89a79-1544-497e-9d64-169452efdb7b\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"52b89a79-1544-497e-9d64-169452efdb7b\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "52b89a79-1544-497e-9d64-169452efdb7b"}]}}
{"time": "2024-02-07T22:30:44.8580738Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "78737df2-ee1d-4fb4-96d5-a9c5aab5bfe9", "Level": 4, "properties": {"id": "Directory_78737df2-ee1d-4fb4-96d5-a9c5aab5bfe9_BLGGV_23591754", "category": "ApplicationManagement", "correlationId": "78737df2-ee1d-4fb4-96d5-a9c5aab5bfe9", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:30:44.8580738+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "f1290977-c73a-4e0b-b7c6-c1262a4475b5", "displayName": "Malicious7", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"52b89a79-1544-497e-9d64-169452efdb7b\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious7\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "52b89a79-1544-497e-9d64-169452efdb7b"}]}}
{"time": "2024-02-07T22:30:36.4896278Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "286a7f47-e8e6-41aa-8860-b635a6d785c2", "Level": 4, "properties": {"id": "Directory_286a7f47-e8e6-41aa-8860-b635a6d785c2_B431O_22422637", "category": "ApplicationManagement", "correlationId": "286a7f47-e8e6-41aa-8860-b635a6d785c2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:30:36.4896278+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "c2b13d0b-d19b-4b08-951c-5742f4b5fe32", "displayName": "Malicious6", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"4083377d-ef3f-4732-8b15-099905710508\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious6\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"4083377d-ef3f-4732-8b15-099905710508\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"4083377d-ef3f-4732-8b15-099905710508\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "4083377d-ef3f-4732-8b15-099905710508"}]}}
{"time": "2024-02-07T22:30:36.0317415Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "d6cbbb2f-fcd7-4201-82b4-ecffc06e96a3", "Level": 4, "properties": {"id": "Directory_d6cbbb2f-fcd7-4201-82b4-ecffc06e96a3_I4C51_19034325", "category": "ApplicationManagement", "correlationId": "d6cbbb2f-fcd7-4201-82b4-ecffc06e96a3", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:30:36.0317415+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "e9391c34-b130-4f05-8937-0471721787b4", "displayName": "Malicious6", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"4083377d-ef3f-4732-8b15-099905710508\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[false]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious6\"]"}, {"displayName": "RequiredResourceAccess", "oldValue": "[]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]}],\"EncodingVersion\":1}]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "ServicePrincipalLockConfiguration", "oldValue": "[]", "newValue": "[{\"IsEnabled\":true,\"AllProperties\":true,\"CredentialsWithUsageVerify\":true,\"CredentialsWithUsageSign\":true,\"IdentifierUris\":false,\"TokenEncryptionKeyId\":true}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess, PublisherDomain, ServicePrincipalLockConfiguration\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "4083377d-ef3f-4732-8b15-099905710508"}]}}
{"time": "2024-02-07T22:22:14.7111622Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "f4c1aa12-19bc-41dd-8b1d-a93b5a7c653e", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_f4c1aa12-19bc-41dd-8b1d-a93b5a7c653e_VP23Z_18189008", "category": "ApplicationManagement", "correlationId": "f4c1aa12-19bc-41dd-8b1d-a93b5a7c653e", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:22:14.7111622+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "53765d20-af44-4fb0-8ee4-43ad1d3dfe34", "displayName": "Malicious5", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e7c0eb54-6aca-4425-840b-4795349ba1c4\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious5\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e7c0eb54-6aca-4425-840b-4795349ba1c4\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e7c0eb54-6aca-4425-840b-4795349ba1c4\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "e7c0eb54-6aca-4425-840b-4795349ba1c4"}]}}
{"time": "2024-02-07T22:22:02.8361436Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "da6f1896-7555-4ed5-81bc-d71c3b5ed299", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_da6f1896-7555-4ed5-81bc-d71c3b5ed299_R8FU4_17717634", "category": "ApplicationManagement", "correlationId": "da6f1896-7555-4ed5-81bc-d71c3b5ed299", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:22:02.8361436+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "2dd674ee-3a92-40bb-a250-dae30cc15390", "displayName": "Malicious5", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"e7c0eb54-6aca-4425-840b-4795349ba1c4\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious5\"]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, PublisherDomain\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "e7c0eb54-6aca-4425-840b-4795349ba1c4"}]}}
{"time": "2024-02-07T22:21:59.2077884Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "c0372589-7f44-4786-9ca1-60ad50265594", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_c0372589-7f44-4786-9ca1-60ad50265594_WVYYZ_19181478", "category": "ApplicationManagement", "correlationId": "c0372589-7f44-4786-9ca1-60ad50265594", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:21:59.2077884+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "86fe3d75-c33a-44f2-a053-a9f39ad6ed95", "displayName": "Malicious4", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"193edd03-d4e0-4816-944a-e6c724d1596f\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious4\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"193edd03-d4e0-4816-944a-e6c724d1596f\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"193edd03-d4e0-4816-944a-e6c724d1596f\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "193edd03-d4e0-4816-944a-e6c724d1596f"}]}}
{"time": "2024-02-07T22:21:46.1088370Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "7bd6ce67-a36c-464f-ae51-de9ab37fa7db", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_7bd6ce67-a36c-464f-ae51-de9ab37fa7db_569U4_19864755", "category": "ApplicationManagement", "correlationId": "7bd6ce67-a36c-464f-ae51-de9ab37fa7db", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:21:46.108837+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "6107408f-a973-4d59-90af-3fd4e36be1e9", "displayName": "Malicious4", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"193edd03-d4e0-4816-944a-e6c724d1596f\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious4\"]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, PublisherDomain\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "193edd03-d4e0-4816-944a-e6c724d1596f"}]}}
{"time": "2024-02-07T22:21:38.6568582Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "6ee1ee94-344d-454d-ba00-6683e1d94384", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_6ee1ee94-344d-454d-ba00-6683e1d94384_R8FU4_17713712", "category": "ApplicationManagement", "correlationId": "6ee1ee94-344d-454d-ba00-6683e1d94384", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:21:38.6568582+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "e1ee614c-ad7c-49a4-8c81-8a0c3054d6e8", "displayName": "Malicious3", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"37f64457-ee20-4177-89b7-68f19faec8f4\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious3\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"37f64457-ee20-4177-89b7-68f19faec8f4\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"37f64457-ee20-4177-89b7-68f19faec8f4\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "37f64457-ee20-4177-89b7-68f19faec8f4"}]}}
{"time": "2024-02-07T22:21:19.4488044Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "385b2ac2-9939-4cd7-9030-858afe0c7dfb", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_385b2ac2-9939-4cd7-9030-858afe0c7dfb_G0WEY_20101210", "category": "ApplicationManagement", "correlationId": "385b2ac2-9939-4cd7-9030-858afe0c7dfb", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:21:19.4488044+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "d4172d8c-16e2-460f-b966-512e77bad7eb", "displayName": "Malicious3", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"37f64457-ee20-4177-89b7-68f19faec8f4\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious3\"]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, PublisherDomain\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "37f64457-ee20-4177-89b7-68f19faec8f4"}]}}
{"time": "2024-02-07T22:21:10.6824114Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "f4fcb6d8-b5c5-4b61-bffd-9022fa3ab9aa", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_f4fcb6d8-b5c5-4b61-bffd-9022fa3ab9aa_VP23Z_18182534", "category": "ApplicationManagement", "correlationId": "f4fcb6d8-b5c5-4b61-bffd-9022fa3ab9aa", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:21:10.6824114+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "b2a5223d-a478-42f6-abde-e292b489e283", "displayName": "Malicious2", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"227bf72b-bde4-4afb-bde0-9c645aa51078\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious2\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"227bf72b-bde4-4afb-bde0-9c645aa51078\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"227bf72b-bde4-4afb-bde0-9c645aa51078\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "227bf72b-bde4-4afb-bde0-9c645aa51078"}]}}
{"time": "2024-02-07T22:20:57.4093829Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "e911197f-7427-46a4-b39c-5259bc0b2256", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_e911197f-7427-46a4-b39c-5259bc0b2256_R8FU4_17708186", "category": "ApplicationManagement", "correlationId": "e911197f-7427-46a4-b39c-5259bc0b2256", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:20:57.4093829+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "85fc7de2-4a2e-4076-bf76-8a915e73828f", "displayName": "Malicious2", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"227bf72b-bde4-4afb-bde0-9c645aa51078\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious2\"]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, PublisherDomain\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "227bf72b-bde4-4afb-bde0-9c645aa51078"}]}}
{"time": "2024-02-07T22:20:49.6334806Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "4718d68e-a814-41f4-b0be-cc16179af594", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_4718d68e-a814-41f4-b0be-cc16179af594_G0WEY_20095839", "category": "ApplicationManagement", "correlationId": "4718d68e-a814-41f4-b0be-cc16179af594", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:20:49.6334806+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "d82b3445-45f8-4668-b750-13f3a7d85a53", "displayName": "Malicious1", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"1095fe98-be87-4ab7-9a63-e44bda4d23f5\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious1\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"1095fe98-be87-4ab7-9a63-e44bda4d23f5\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"1095fe98-be87-4ab7-9a63-e44bda4d23f5\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "1095fe98-be87-4ab7-9a63-e44bda4d23f5"}]}}
{"time": "2024-02-07T22:20:05.9917469Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "69b8bd42-1918-4bd3-944e-7ea45fc2ccba", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_69b8bd42-1918-4bd3-944e-7ea45fc2ccba_WVYYZ_19164759", "category": "ApplicationManagement", "correlationId": "69b8bd42-1918-4bd3-944e-7ea45fc2ccba", "result": "success", "resultReason": "", "activityDisplayName": "Add application", "activityDateTime": "2024-02-07T22:20:05.9917469+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "befab195-6290-4048-9096-b2d551509f3f", "displayName": "Malicious1", "type": "Application", "modifiedProperties": [{"displayName": "AppId", "oldValue": "[]", "newValue": "[\"1095fe98-be87-4ab7-9a63-e44bda4d23f5\"]"}, {"displayName": "AvailableToOtherTenants", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious1\"]"}, {"displayName": "PublisherDomain", "oldValue": "[]", "newValue": "[\"phantomengineering.onmicrosoft.com\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AppId, AvailableToOtherTenants, DisplayName, PublisherDomain\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "1095fe98-be87-4ab7-9a63-e44bda4d23f5"}]}}