This detection watches Azure Active Directory AuditLogs for Update application or Update service principal operations that modify FederatedIdentityCredentials on a service principal (Entra ID). It flags additions to federated identity credentials, which enable workload identities (OIDC) from external issuers to authenticate as the service principal without a secret. The rule parses the audit event to identify the target SP, the actor (user or app that initiated the change), and the new vs. old FederatedIdentityCredentials values. It extracts the newly configured credential names and compares them to determine if new credentials were added, then surfaces a finding with the involved SP, issuer, and credentials. This is a persistence-focused, secretless access technique that can survive credential rotations and evade standard secrets monitoring. The detection is designed to trigger when new federated credentials are introduced, potentially allowing an attacker to retain access through a trusted OIDC issuer. The rule maps to MITRE ATT&CK techniques related to account manipulation and credential access, and includes references to workload identity federation documentation and GitHub Actions/Kubernetes federation use cases. It provides remediation guidance and notes potential false positives where legitimate engineering work involves federated credentials, advising validation of the actor, target SP, and issuer against trusted providers. The implementation guidance specifies using the Splunk Add-on for Microsoft Cloud Services to ingest AAD events via EventHub and the azure:monitor:aad sourcetype with AuditLogs data, ensuring the analytic can correlate the relevant fields and produce a scoped alert with attacker, target, time window, and credential changes.