The service principals in Microsoft's Entra ID can be a boon for business email compromise, but they’re also a key log source for detection.