MDI Service Accounts without Service Principals and MSAs

Exclude gMSA/dMSA

Detection Query

IdentityInfo
| where Timestamp > ago(30d)
| where Type == @"ServiceAccount"
| extend ["Service On-Prem Sid"] = OnPremObjectId
| extend ["Service Principal Name"] = iff(IdentityEnvironment == "OnPremises",replace_string(strcat(AccountName, "@",AccountDomain),"$",""), AccountUpn )
| where parse_json(UserAccountControl)[0] != 'WorkstationTrustAccount' //Exclude gMSA/dMSA
| where not (ChangeSource == @"System-UserPersistence" and isempty(CloudSid)) //Exclude Service Principals
| summarize arg_max(Timestamp,*) by AccountObjectId,CloudSid,['Service On-Prem Sid']

Tags