Curious and so far unexplainable question.

Exchange admin center decided to flip for login enabled to disabled all on its own today. On digging into the unified audit log I saw the following:

Operation

Update service principal.

ModifiedProperties

[
    {
        "Name": "AccountEnabled",
        "NewValue": "[rn  falsern]",
        "OldValue": "[rn  truern]"
    },
    {
        "Name": "Included Updated Properties",
        "NewValue": "AccountEnabled",
        "OldValue": ""
    },
    {
        "Name": "TargetId.ServicePrincipalNames",
        "NewValue": "497effe9-df71-4043-a8bb-14cf78c4b63b",
        "OldValue": ""
    }
]

Actor

[
    {
        "ID": "Microsoft Online Services",
        "Type": 1
    },
    {
        "ID": "Certificate",
        "Type": 2
    },
    {
        "ID": "Other",
        "Type": 2
    }
]

The Exchange Admin Center application (497effe9-df71-4043-a8bb-14cf78c4b63b) is standard and matches the application ID here.

Any idea what or why caused this event to occur?
It is the first time I see this happening.

The only other thing I have to add is that the ActorContextID matches my OrganizationId for the record.