Redacting a secret isn't remediation: What Storm-3168 teaches us about non-human identity

Microsoft analyzed 'Storm-3168', where exposed Azure service-principal credentials enabled attackers linked to JADEPUFFER to rapidly enumerate an environment and perform automated destructive actions (including >100 storage deletion attempts). The write-up attributes the incident to a leaked client secret that remained valid after removal, overprivileged non-human identities, and absent credential rotation; it recommends credential rotation, least-privilege, identity lifecycle controls, behavioral baselining, and detection to reduce similar risks.