Azure unknown Service Prinicple Sign-In

Question

When checking the Service principle sign-ins in Azure I observed sign-ins from an unknown service principle id.

Application ID: cd2655bb-e68e-4e10-9818-740bbad26507
Service Principle ID: 00000000-0000-0000-0000-000000000000
Service principal name: prod-app-access-hermes
Status: Success
IP address: 51.138.218.64

The service principle does not exist. And I'm unclear if it ever existed. I checked the following:

• Enterprise apps
• Audit logs (to see if anything was deleted)
• App registrations

I cannot seem to find the initiating service. Anyone has an idea on how to trace it and prevent the sign-in?

Answer 1

I noticed one of these in my audit log exports and reached out to Microsoft regarding it - according to my Microsoft Azure Support Engineer:

For your future reference, I discussed your concern related to prod-app-access-hermes app with my internal team and they informed that it is a Microsoft backend application that primarily works with Azure Cloud sync. As it is a backend app, there's no public documentation about it.