How to Export Azure AD Application Usage Report in Microsoft 365

Service principal sign-ins refer to the authentication and activity logs associated with the identities used by Entra ID applications to access resources within Microsoft 365 services. When a service principal signs in, it performs actions such as accessing APIs, managing resources, or performing tasks on behalf of an application.

Monitoring these sign-ins helps track records of both successful and failed attempts, providing insight into whether the service principal is being used correctly or if potential security issues exist.

Monitor service principal sign-in logs using the Microsoft Entra admin center

• Navigate to Service principal sign-ins under Identity »Monitoring & health»Sign-in logs.
• The service principal sign-in logs provide information such as sign-in status, service principal name, resource ID, sign-in date and time, IP address, conditional access, and more.

Note: To obtain a comprehensive summary of each application's service principal sign-in, navigate to the Service principal sign-in activity report under Identity»Monitoring & health»Usage and insights.

• AdminDroid’s sign-in by apps and service principals report offers granular insights, including detailed sign-in time, application names, geographical data, and more.
• The built-in heatmap chart helps you quickly spot peak activity and low sign-in days, making it easier to detect unusual service principal usage patterns.

Monitoring sign-in failures is essential for smooth operation within Microsoft 365. By identifying and understanding the top sign-in errors for Azure AD apps, admins can proactively troubleshoot issues such as application logins failing to meet conditional access policies, application-related issues, and more. This helps ensure the security and reliability of their organization's digital resources.

Track top Azure AD app sign-in failures using the Microsoft Entra admin center

• Navigate to Sign-in logs under Identity »Applications»Enterprise applications»Activity.
• Adjust the Date filter as needed. In the Add filters option, choose the Status field, and choose Failure from the Status drop-down.
• Click on the Application column header to sort the report by app.

Note: You can also set the filter to Success or Interrupted from the Status drop-down to analyze those sign-ins for Azure AD applications.

The application credential activity report offers a centralized view of your application credentials, detailing the last activity date, credential type (certificate or client secret), and expiration dates. Monitoring credential expiration dates is essential to ensure that the credentials of registered applications and service principals are up to date.

• Navigate to the Application credential activity (Preview) report under the Usage & insights tab.
• Utilize the 'View more details' link available in the respective record to access information such as the application object, service principal, resource IDs, credential origin, and more.

• AdminDroid's Credential Changes report provides a detailed audit of service principal credential operations, allowing you to track changes like added or removed credentials.
• This report offers insights into event time, operation type, user ID, and target ID, helping you manage credential updates for smooth operations.

Pro tip: Utilize the Schedule option to receive the service principal changes report periodically to your mailbox.

Disabling user sign-ins for applications in Entra ID is a crucial step for managing application access and ensuring security. This process allows administrators to control which applications users can access, either temporarily or permanently, based on organizational needs or security policies. By default, user sign-ins for applications are enabled.

• Navigate to the Identity »Applications»Enterprise applications»All applications.
• Select the application you want to disable user sign-ins for. Then, go to the Properties tab.
• Disable the 'Enabled for users to sign-in?' toggle, then click Save.

Run the below PowerShell cmdlet to disable user sign-in for an Azure AD application.

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$servicePrincipal = Get-MgServicePrincipal -Filter "appId eq '<App ID>'"
Update-MgServicePrincipal -ServicePrincipalId $servicePrincipal.Id -AccountEnabled:$false

Replace the <App ID> with the client ID of the target application.

Run the below cmdlet, to list all the enterprise applications where user sign-in is disabled.

Get-MgServicePrincipal -Filter "accountEnabled eq false"