KQL Search

//Find Azure AD service principals that are logging on from multiple locations, this should be less common than with user accounts

//Data connector required for this query - Azure Active Directory - Service Principal Signin Logs

//Return the IP addresses used to sign in and see if you can build conditional access policies around them
//Microsoft Sentinel Query
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "0"
| where isnotempty(Location)
| summarize
    ['Count of Locations']=dcount(Location),
    ['List of Locations']=make_set(Location),
    ['Count of IP Addresses']=dcount(IPAddress),
    ['List of IP Addresses']=make_set(IPAddress)
    by ServicePrincipalName, AppId
| where ['Count of Locations'] >= 2

//Advanced Hunting query

//Data connector required for this query - Advanced Hunting with Azure AD P2 License

AADSpnSignInEventsBeta
| where Timestamp > ago(30d)
| where ErrorCode == "0"
| where isnotempty(Country)
| summarize
    ['Count of Locations']=dcount(Country),
    ['List of Locations']=make_set(Country),
    ['Count of IP Addresses']=dcount(IPAddress),
    ['List of IP Addresses']=make_set(IPAddress)
    by ServicePrincipalName, ApplicationId
| where ['Count of Locations'] >= 2