Verify first-party Microsoft applications in sign-in reports

When you review your sign-in reports, you might see an application in your sign-in report that you don't own and want to identify. You also might wonder how you signed in to that app, if you don't remember accessing the app.

Here's an example sign-in report:

For example, when you access learn.microsoft.com, the application that's shown in the sign-in log may show dev-rel-auth-prod, but this isn't descriptive of learn.microsoft.com.

Although the apps that are listed in sign-in reports are owned by Microsoft and aren't suspicious applications, you can determine whether Microsoft owns a Microsoft Entra service principal that's found in your Microsoft Entra logs.

Verify a first-party Microsoft service principal in your Microsoft Entra tenant

1. Open the list of enterprise applications in Microsoft Entra ID.

2. In the navigation pane, select All applications.

3. In the Application Type drop-down list, select Microsoft Applications, and then select Apply. All applications that are listed here are owned by Microsoft.

   

4. In the search box below the drop-down lists, filter the Microsoft application list by adding a specific Display Name or Application ID.

   

5. Select the desired app, and then select Properties in the navigation pane to view the listed app's properties. Verify that you see the following error message:

   You can't delete this application because it's a Microsoft first party application.
   

   

Verify a first-party Microsoft service principal through PowerShell

1. Open the Azure Active Directory module in PowerShell.

2. In the PowerShell module, enter the following cmdlet:

   Get-AzureADServicePrincipal -Filter "DisplayName eq '<display-name>'" | fl *
   

   Replace <display name> with the app's actual display name.

   Note

   Azure AD and MSOnline PowerShell modules are deprecated as of March 30, 2024. To learn more, read the deprecation update. After this date, support for these modules are limited to migration assistance to Microsoft Graph PowerShell SDK and security fixes. The deprecated modules will continue to function through March, 30 2025.

   We recommend migrating to Microsoft Graph PowerShell to interact with Microsoft Entra ID (formerly Azure AD). For common migration questions, refer to the Migration FAQ. Note: Versions 1.0.x of MSOnline may experience disruption after June 30, 2024.

3. Review the result's AppOwnerTenantId.

   

   In the screenshot, f8cdef31-a31e-4b4a-93e4-5f571e91255a is the Microsoft Service's Microsoft Entra tenant ID.

Application IDs of commonly used Microsoft applications

The following table lists some, but not all, first-party Microsoft applications. You may see these applications in the Sign-ins report in Microsoft Entra ID.

Application IDs of Microsoft tenant-owned applications

The following table lists some, but not all, Microsoft tenant-owned applications (tenant ID: 72f988bf-86f1-41af-91ab-2d7cd011db47).

More information

For more information, see Sign-in activity reports in the Microsoft Entra admin center.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.