---
title: Azure service principal re-enabled after being disabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure service principal re-enabled
  after being disabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure service principal re-enabled after being disabled
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects an Azure service principal being re-enabled after previously being disabled.

## Strategy{% #strategy %}

This rule monitors Microsoft Entra audit logs where `@ocsf.metadata.event_code` is `"Update service principal"` and `@properties.targetResources.modifiedProperties.displayName` is `AccountEnabled`, with `@properties.targetResources.modifiedProperties.oldValue` of `[false]` transitioning to `@properties.targetResources.modifiedProperties.newValue` of `[true]`.

## Triage and response{% #triage-and-response %}

- Identify the administrator `{{@ocsf.actor.user.uid}}` who re-enabled the service principal and verify whether they have a documented reason for the change, such as planned remediation or an application migration.
- Review the service principal's `@properties.targetResources.displayName` and `@properties.targetResources.id` to determine which application or integration it belongs to and whether it is still expected to be in use.
- Determine why the service principal was originally disabled by reviewing prior `"Update service principal"` audit events for the same `@properties.targetResources.id`, including any security investigation or incident that led to the disablement.
- Examine the service principal's assigned permissions, role assignments, and credentials (client secrets or certificates) for signs of unauthorized modification.
- Check for suspicious sign-in or API activity from the service principal to confirm whether it is being used for legitimate purposes.