// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Service principal sign-ins for one application, flagging the exposed credential.
let TargetAppId = "REPLACE_WITH_APPLICATION_CLIENT_ID";
let ExposedCredentialKeyId = "REPLACE_WITH_SECRET_OR_CERTIFICATE_KEY_ID";
let WindowStart = datetime(2026-01-01T00:00:00Z);  // REPLACE: first possible exposure, UTC
AADServicePrincipalSignInLogs
| where TimeGenerated between (WindowStart .. now())
| where AppId =~ TargetAppId
| extend UsedExposedCredential = ServicePrincipalCredentialKeyId =~ ExposedCredentialKeyId
| project TimeGenerated, ServicePrincipalName, AppId, ServicePrincipalCredentialKeyId,
    UsedExposedCredential, ClientCredentialType, IPAddress, ResourceDisplayName,
    ResultType
| order by TimeGenerated asc
| take 500