A retired radar integration’s service principal still has Contributor on a production resource group, even though the team says the app registration lives in another tenant. What should the security engineer do first?
Select an answer to reveal the explanation.
Short Explanation
That radar ghost still has a badge to production. Kill sign-in, yank Contributor, and shred leftover secrets—don’t hide behind “the app is in another tenant.”
Full Explanation
A service principal that retains an Azure RBAC assignment can still act on resources until that assignment is removed and sign-in is disabled. Cross-tenant app registration does not make a local role assignment harmless. Lifecycle hygiene for application access includes disabling the principal, removing unused credentials, and clearing Azure roles on production scopes. Defender for Cloud inventory and management-group moves do not substitute for cleaning the principal’s access.