// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel Entra workload sign-ins + directory audit; needs both ingestions and read permission.
// Use a tenant service-principal object ID, not a public client AppId. Last 24h; at most 100 pairs.
let Principal = "REPLACE_WITH_SERVICE_PRINCIPAL_OBJECT_ID";
let Starts = AADServicePrincipalSignInLogs
    | where TimeGenerated between (ago(24h) .. now())
    | where ServicePrincipalId == Principal and ResultType in~ ("0", "Success")
    | project PrincipalId=ServicePrincipalId, SignInTime=TimeGenerated, IPAddress, ResourceDisplayName;
let Changes = AuditLogs
    | where TimeGenerated between (ago(24h) .. now())
    | where Result =~ "success"
    | extend PrincipalId=tostring(InitiatedBy.app.servicePrincipalId)
    | where PrincipalId == Principal
    | where OperationName matches regex @"(?i)(credential|certificate|secret|owner|role)"
    | project PrincipalId, ChangeTime=TimeGenerated, OperationName, TargetResources, CorrelationId;
Starts
| join kind=inner Changes on PrincipalId
| where ChangeTime between (SignInTime .. (SignInTime + 30m))
| project SignInTime, ChangeTime, PrincipalId, IPAddress, ResourceDisplayName,
    OperationName, TargetResources, CorrelationId
| order by ChangeTime desc
| take 100