Verify first-party Microsoft applications in sign-in reports

When you review your sign-in reports, you might see an application in your sign-in report that you don't own and want to identify. You also might wonder how you signed in to that app, if you don't remember accessing the app.

Here's an example sign-in report:

For example, when you access learn.microsoft.com, the application that's shown in the sign-in log may show dev-rel-auth-prod, but this isn't descriptive of learn.microsoft.com.

Although the apps that are listed in sign-in reports are owned by Microsoft and aren't suspicious applications, you can determine whether Microsoft owns a Microsoft Entra service principal that's found in your Microsoft Entra logs.

Verify a first-party Microsoft service principal in your Microsoft Entra tenant

1. Open the list of enterprise applications in Microsoft Entra ID.

2. In the navigation pane, select All applications.

3. In the Application Type drop-down list, select Microsoft Applications, and then select Apply. All applications that are listed here are owned by Microsoft.

   

4. In the search box below the drop-down lists, filter the Microsoft application list by adding a specific Display Name or Application ID.

   

5. Select the desired app, and then select Properties in the navigation pane to view the listed app's properties. Verify that you see the following error message:

   You can't delete this application because it's a Microsoft first party application.
   

   

Verify a first-party Microsoft service principal through PowerShell

Using Microsoft Graph PowerShell SDK

1. Open PowerShell, import Microsoft Graph PowerShell SDK and then connect to Microsoft Entra ID:

   Import-Module Microsoft.Graph.Applications
   Connect-MgGraph
   

2. In the PowerShell command-line, enter the display name of the application and run the following cmdlet:

   $appDisplayName = '<display name>'
   Get-MgServicePrincipal -Filter "DisplayName eq '$appDisplayName'" | Select-Object Id, DisplayName, SignInAudience, AppOwnerOrganizationId
   

3. Review the AppOwnerTenantId value in the output.

   

   In the screenshot, f8cdef31-a31e-4b4a-93e4-5f571e91255a is the Microsoft Service's Microsoft Entra tenant ID.

Using Microsoft Entra PowerShell

1. Open PowerShell, import Microsoft Graph PowerShell SDK and connect to Microsoft Entra ID:

   Import-Module Microsoft.Entra
   Connect-Entra
   

2. In the PowerShell command-line, enter the display name of the application and run the following cmdlet:

   $appDisplayName = '<display name>'
   Get-EntraServicePrincipal -SearchString $appDisplayName | Select-Object Id, DisplayName, SignInAudience, AppOwnerOrganizationId
   

3. Review the result's AppOwnerTenantId.

   

   In the screenshot, f8cdef31-a31e-4b4a-93e4-5f571e91255a is the Microsoft Service's Microsoft Entra tenant ID.

Application IDs of commonly used Microsoft applications

The following table lists some, but not all, first-party Microsoft applications. You may see these applications in the Sign-ins report in Microsoft Entra ID.

Application IDs of Microsoft tenant-owned applications

The following table lists some, but not all, Microsoft tenant-owned applications (tenant ID: 72f988bf-86f1-41af-91ab-2d7cd011db47).

More information

For more information, see Sign-in activity reports in the Microsoft Entra admin center.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.