First, the threat actor used a compromised O365 administrator account to create a new Service Principal with a generic name. This Service Principal was granted company administrator privileges. From there, the threat actor added a credential to this Service Principal so that they could access the Service Principal directly, without use of an O365 user account