---
title: Azure agent identity authenticated with a client secret
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure agent identity authenticated with
  a client secret
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure agent identity authenticated with a client secret
Classification:attackTactic:[TA0001-initial-access](https://attack.mitre.org/tactics/TA0001)Technique:[T1078-valid-accounts](https://attack.mitre.org/techniques/T1078) 
## Goal{% #goal %}

Detects an Azure AI Foundry agent identity signing in with a client secret credential. Agent identities are expected to authenticate with certificates or federated credentials, not client secrets.

## Strategy{% #strategy %}

This rule monitors Azure Active Directory service principal sign-in logs whose `@properties.clientCredentialType` is `clientSecret`. Agent identities backing hosted AI agents (for example Azure AI Foundry hosted agents) are designed to authenticate through certificate-based or federated credential flows, which do not expose a long-lived secret.

## Triage & Response{% #triage--response %}

- Identify the agent identity behind `{{@ocsf.actor.user.uid}}` and confirm whether it corresponds to a known, currently deployed hosted agent or AI workload.
- Review `{{@properties.appDisplayName}}` and `{{@properties.resourceDisplayName}}` to confirm the sign-in target matches the expected application or resource for this agent.
- Check the sign-in's `{{@network.client.ip}}` and `{{@network.client.geoip.country.name}}` for consistency with where this agent identity is expected to run.
- If the activity is confirmed to be from a compromised agent identity, rotate or remove the client secet.
- Consider switching this agent identity authentication method to a certificate or federated credential if feasible.