PA-08: Risky Service Principal Detection

PA-08 is a security control that compromised service principals provide persistent, automated access to your tenant. unlike user accounts, service principals operate without mfa and can perform actions at scale. detecting risky service principals is critical for preventing supply chain attacks. It requires that identity protection monitors service principal risk and no medium or high-risk service principals are active, compromised service principals are investigated and disabled promptly.

Compromised service principals provide persistent, automated access to your tenant. Unlike user accounts, service principals operate without MFA and can perform actions at scale. Detecting risky service principals is critical for preventing supply chain attacks.

Can disable compromised service principals. Requires Workload Identities Premium.

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

PA-08 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.

PA-08 is rated critical because failure to implement this control significantly increases the risk of security incidents. Compromised service principals provide persistent, automated access to your tenant. Unlike user accounts, service principals operate without MFA and can perform actions at scale. Detecting risky service principals is critical for preventing supply chain attacks.