Microsoft Defender for Cloud Azure-Microsoft.Security

operationName	Description	Sample	Rule
any	Catch-all for Azure-Microsoft.Security rules that match the resource provider but no specific operation.	N	N
Microsoft.Security/adaptiveNetworkHardenings/enforce/action	Enforces the given traffic hardening rules by creating matching security rules on the given Network Security Group(s)	N	N
Microsoft.Security/advancedThreatProtectionSettings/write	Updates the Advanced Threat Protection Settings for the resource	N	N
Microsoft.Security/aggregations/action	Gets aggregations	N	N
Microsoft.Security/alertsSuppressionRules/delete	Delete a security alert suppression rule	N	N
Microsoft.Security/alertsSuppressionRules/write	Creates a new security alert suppression rule or update an existing rule	N	Y
Microsoft.Security/apiCollections/delete	Delete Api Collections	N	N
Microsoft.Security/apiCollections/write	Create Api Collections	N	N
Microsoft.Security/applicationWhitelistings/write	Creates a new application allowlisting or updates an existing one	N	N
Microsoft.Security/assessmentMetadata/write	Create or update a security assessment metadata	N	N
Microsoft.Security/assessments/governanceAssignments/write	Create or update governance assignments for security assessments	N	N
Microsoft.Security/assessments/subAssessments/write	Create or update security sub assessments on your subscription	N	N
Microsoft.Security/assessments/write	Create or update security assessments on your subscription	N	N
Microsoft.Security/assignments/delete	Deletes the security assignment	N	N
Microsoft.Security/assignments/write	Create or update the security assignment	N	N
Microsoft.Security/automations/delete	Deletes the automation for the scope	N	N
Microsoft.Security/automations/validate/action	Validates the automation model for the scope	N	N
Microsoft.Security/automations/write	Creates or updates the automation for the scope	N	N
Microsoft.Security/autoProvisioningSettings/write	Microsoft Defender for Cloud auto-provisioning setting write, recorded in the activity log when the automatic provisioning of the monitoring agent is configured. Defense-evasion-relevant: turning auto-provisioning off stops new resources from being onboarded to Defender monitoring. Captured in first-party AzureActivity telemetry; the ARM providerOperations registry does not enumerate it.	Y	N
Microsoft.Security/customRecommendations/delete	Deletes the custom recommendation	N	N
Microsoft.Security/customRecommendations/write	Create or update the custom recommendation	N	N
Microsoft.Security/datascanners/delete	Deletes the datascanners for the scope	N	N
Microsoft.Security/datascanners/write	Creates or updates the datascanners for the scope	N	N
Microsoft.Security/defenderforstoragesettings/delete	Deletes the defenderforstoragesettings for the scope	N	N
Microsoft.Security/defenderforstoragesettings/write	Creates or updates the defenderforstoragesettings for the scope	N	N
Microsoft.Security/deviceSecurityGroups/delete	Deletes IoT device security groups	N	N
Microsoft.Security/deviceSecurityGroups/write	Creates or updates IoT device security groups	N	N
Microsoft.Security/governanceRules/write	Create or update governance rules for managing security posture	N	N
Microsoft.Security/informationProtectionPolicies/write	Updates the information protection policies for the resource	N	N
Microsoft.Security/integration/delete	Deleate or update integration on your scope	N	N
Microsoft.Security/integration/write	Create or update integration on your scope	N	N
Microsoft.Security/iotDefenderSettings/delete	Deletes IoT Defender Settings	N	N
Microsoft.Security/iotDefenderSettings/DownloadManagerActivation/action	Download manager activation file with subscription quota data	N	N
Microsoft.Security/iotDefenderSettings/PackageDownloads/action	Gets downloadable IoT Defender packages information	N	N
Microsoft.Security/iotDefenderSettings/write	Create or updates IoT Defender Settings	N	N
Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts/dismiss/action	Dismisses IoT aggregated alerts	N	N
Microsoft.Security/iotSecuritySolutions/delete	Deletes IoT security solutions	N	N
Microsoft.Security/iotSecuritySolutions/write	Creates or updates IoT security solutions	N	N
Microsoft.Security/iotSensors/delete	Deletes IoT Sensors	N	N
Microsoft.Security/iotSensors/DownloadActivation/action	Downloads activation file for IoT Sensors	N	N
Microsoft.Security/iotSensors/DownloadResetPassword/action	Downloads reset password file for IoT Sensors	N	N
Microsoft.Security/iotSensors/TriggerTiPackageUpdate/action	Triggers threat intelligence package update	N	N
Microsoft.Security/iotSensors/write	Create or updates IoT Sensors	N	N
Microsoft.Security/iotSite/delete	Deletes IoT site	N	N
Microsoft.Security/iotSite/write	Creates or updates IoT site	N	N
Microsoft.Security/locations/alerts/activate/action	Activate a security alert	N	N
Microsoft.Security/locations/alerts/dismiss/action	Dismiss a security alert	N	N
Microsoft.Security/locations/alerts/resolve/action	Resolve a security alert	N	N
Microsoft.Security/locations/alerts/simulate/action	Simulate a security alert	N	N
Microsoft.Security/locations/jitNetworkAccessPolicies/delete	Deletes the just-in-time network access policy	N	N
Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action	Initiates a just-in-time network access policy request	N	N
Microsoft.Security/locations/jitNetworkAccessPolicies/write	Creates a new just-in-time network access policy or updates an existing one	N	N
Microsoft.Security/locations/securitySolutions/delete	Deletes a security solution	N	N
Microsoft.Security/locations/securitySolutions/write	Creates a new security solution or updates an existing one	N	N
Microsoft.Security/locations/tasks/activate/action	Activate a security recommendation	N	N
Microsoft.Security/locations/tasks/dismiss/action	Dismiss a security recommendation	N	N
Microsoft.Security/locations/tasks/resolve/action	Resolve a security recommendation	N	N
Microsoft.Security/locations/tasks/start/action	Start a security recommendation	N	N
Microsoft.Security/policies/write	Updates the security policy	N	N
Microsoft.Security/pricings/action	Updates batch of pricing settings for the scope	N	N
Microsoft.Security/pricings/delete	Deletes the pricing settings for the scope	N	N
Microsoft.Security/pricings/securityoperators/delete	Deletes the security operators for the scope	N	N
Microsoft.Security/pricings/securityoperators/write	Updates the security operators for the scope	N	N
Microsoft.Security/pricings/write	Updates the pricing settings for the scope	N	N
Microsoft.Security/privateLinks/delete	Deletes a Microsoft Security Private Link.	N	N
Microsoft.Security/privateLinks/privateEndpointConnectionProxies/delete	Deletes a Microsoft Security Private Endpoint Connection Proxy (NRP only).	N	N
Microsoft.Security/privateLinks/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action	Updates the properties of the Microsoft Security Private Endpoint Connection Proxy (NRP only).	N	N
Microsoft.Security/privateLinks/privateEndpointConnectionProxies/validate/action	Validates a Microsoft Security Private Endpoint Connection Proxy object before creation (NRP only).	N	N
Microsoft.Security/privateLinks/privateEndpointConnectionProxies/write	Creates or updates a Microsoft Security Private Endpoint Connection Proxy (NRP only).	N	N
Microsoft.Security/privateLinks/privateEndpointConnections/delete	Deletes a Microsoft Security Private Endpoint Connection.	N	N
Microsoft.Security/privateLinks/privateEndpointConnections/write	Approves or rejects a Microsoft Security Private Endpoint Connection.	N	N
Microsoft.Security/privateLinks/write	Creates or updates a Microsoft Security Private Link.	N	N
Microsoft.Security/register/action	Registers the subscription for Azure Security Center	N	N
Microsoft.Security/securityConnectors/delete	Deletes the security connector	N	N
Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/projects/repos/write	Creates or updates a monitored Azure DevOps repository resource.	N	N
Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/projects/write	Creates or updates a monitored Azure DevOps project resource.	N	N
Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/write	Creates or updates monitored Azure DevOps organization details.	N	N
Microsoft.Security/securityConnectors/devops/delete	Deletes a DevOps Connector.	N	N
Microsoft.Security/securityConnectors/devops/gitHubOwners/repos/issues/action	Creates a GitHub issue for the specified repository and assessment.	N	N
Microsoft.Security/securityConnectors/devops/gitLabGroups/listSubgroups/action	Gets nested subgroups of given GitLab Group which are onboarded to the connector.	N	N
Microsoft.Security/securityConnectors/devops/listAvailableAzureDevOpsOrgs/action	Returns a list of all Azure DevOps organizations accessible by the user token consumed by the connector.	N	N
Microsoft.Security/securityConnectors/devops/listAvailableGitHubOwners/action	Returns a list of all GitHub owners accessible by the user token consumed by the connector.	N	N
Microsoft.Security/securityConnectors/devops/listAvailableGitLabGroups/action	Returns a list of all GitLab groups accessible by the user token consumed by the connector.	N	N
Microsoft.Security/securityConnectors/devops/write	Creates or updates a DevOps Configuration.	N	N
Microsoft.Security/securityConnectors/write	Updates the security connector	N	N
Microsoft.Security/securityContacts/delete	Deletes the security contact	N	N
Microsoft.Security/securityContacts/write	Updates the security contact	N	N
Microsoft.Security/securityoperators/delete	Deletes the securityoperators for the scope	N	N
Microsoft.Security/securityoperators/write	Creates or updates the securityoperators for the scope	N	N
Microsoft.Security/securitySolutions/delete	Deletes a security solution	N	N
Microsoft.Security/securitySolutions/write	Creates a new security solution or updates an existing one	N	N
Microsoft.Security/securityStandards/delete	Deletes the security standard	N	N
Microsoft.Security/securityStandards/write	Create or update the security standard	N	N
Microsoft.Security/sensitivitySettings/write	Updates tenant level sensitivity settings	N	N
Microsoft.Security/serverVulnerabilityAssessments/delete	Remove a server vulnerability assessments solution from a resource	N	N
Microsoft.Security/serverVulnerabilityAssessments/write	Create or update a server vulnerability assessments solution on resource	N	N
Microsoft.Security/serverVulnerabilityAssessmentsSettings/delete	Remove server vulnerability assessments settings from a given subscription	N	N
Microsoft.Security/serverVulnerabilityAssessmentsSettings/write	Create or update server vulnerability assessments settings on a given subscription	N	N
Microsoft.Security/settings/write	Updates the settings for the scope	N	N
Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/action	Add a list of rules result to the baseline.	N	N
Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/delete	Remove the rule result from the baseline.	N	N
Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/write	Change the rule baseline result.	N	N
Microsoft.Security/sqlVulnerabilityAssessments/delete	Delete SQL Vulnerability Assessment settings.	N	N
Microsoft.Security/sqlVulnerabilityAssessments/write	Create or update SQL Vulnerability Assessment settings.	N	N
Microsoft.Security/standardAssignments/delete	Deletes the standard assignment	N	N
Microsoft.Security/standardAssignments/write	Create or update the standard assignment	N	N
Microsoft.Security/standards/delete	Deletes the security standard	N	N
Microsoft.Security/standards/write	Create or update the security standard	N	N
Microsoft.Security/unregister/action	Unregisters the subscription from Azure Security Center	N	N
Microsoft.Security/webApplicationFirewalls/delete	Deletes a web application firewall	N	N
Microsoft.Security/webApplicationFirewalls/write	Creates a new web application firewall or updates an existing one	N	N
Microsoft.Security/workspaceSettings/connect/action	Change workspace settings reconnection settings	N	N
Microsoft.Security/workspaceSettings/delete	Deletes the workspace settings	N	N
Microsoft.Security/workspaceSettings/write	Updates the workspace settings	N	N

any: Microsoft Defender for Cloud (catch-all)

Namespace: Microsoft.Security

Description

Catch-all for Azure-Microsoft.Security rules that match the resource provider but no specific operation.

Microsoft.Security/adaptiveNetworkHardenings/enforce/action

Namespace: Microsoft.Security

Description

Enforces the given traffic hardening rules by creating matching security rules on the given Network Security Group(s)

Microsoft.Security/advancedThreatProtectionSettings/write

Namespace: Microsoft.Security

Description

Updates the Advanced Threat Protection Settings for the resource

Microsoft.Security/aggregations/action

Namespace: Microsoft.Security

Description

Gets aggregations

Microsoft.Security/alertsSuppressionRules/delete

Namespace: Microsoft.Security

Description

Delete a security alert suppression rule

Microsoft.Security/alertsSuppressionRules/write

Namespace: Microsoft.Security

Description

Creates a new security alert suppression rule or update an existing rule

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	1 rule	panther
`resultType` (panther rule field)	in	`Success`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Azure Suppression Rule Created source medium: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Elastic #

Azure Diagnostic Settings Alert Suppression Rule Created or Modified source low: Identifies the creation of suppression rules in Azure. Suppression rules are a mechanism used to suppress alerts previously identified as false positives or too noisy to be in production. This mechanism can be abused or mistakenly configured, resulting in defense evasions and loss of security visibility.T1562, T1562.001

Panther #

Azure Alert Suppression Rule Created or Modified source low: Detects when an Azure Security Center alert suppression rule is created or modified. Alert suppression rules allow filtering of specific security alerts to reduce noise, but adversaries may abuse this feature to silence alerts related to their malicious activities. While legitimate use cases exist (suppressing known false positives), new suppression rules should be reviewed to ensure they don't hide indicators of compromise.T1562

Microsoft.Security/apiCollections/delete

Namespace: Microsoft.Security

Description

Delete Api Collections

Microsoft.Security/apiCollections/write

Namespace: Microsoft.Security

Description

Create Api Collections

Microsoft.Security/applicationWhitelistings/write

Namespace: Microsoft.Security

Description

Creates a new application allowlisting or updates an existing one

Microsoft.Security/assessmentMetadata/write

Namespace: Microsoft.Security

Description

Create or update a security assessment metadata

Microsoft.Security/assessments/governanceAssignments/write

Namespace: Microsoft.Security

Description

Create or update governance assignments for security assessments

Microsoft.Security/assessments/subAssessments/write

Namespace: Microsoft.Security

Description

Create or update security sub assessments on your subscription

Microsoft.Security/assessments/write

Namespace: Microsoft.Security

Description

Create or update security assessments on your subscription

Microsoft.Security/assignments/delete

Namespace: Microsoft.Security

Description

Deletes the security assignment

Microsoft.Security/assignments/write

Namespace: Microsoft.Security

Description

Create or update the security assignment

Microsoft.Security/automations/delete

Namespace: Microsoft.Security

Description

Deletes the automation for the scope

Microsoft.Security/automations/validate/action

Namespace: Microsoft.Security

Description

Validates the automation model for the scope

Microsoft.Security/automations/write

Namespace: Microsoft.Security

Description

Creates or updates the automation for the scope

Microsoft.Security/autoProvisioningSettings/write

Namespace: Microsoft.Security

Description

Microsoft Defender for Cloud auto-provisioning setting write, recorded in the activity log when the automatic provisioning of the monitoring agent is configured. Defense-evasion-relevant: turning auto-provisioning off stops new resources from being onboarded to Defender monitoring. Captured in first-party AzureActivity telemetry; the ARM providerOperations registry does not enumerate it.

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Security/autoProvisioningSettings/default",
    "action": "Microsoft.Security/autoProvisioningSettings/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Security/autoProvisioningSettings/default",
    "action": "Microsoft.Security/autoProvisioningSettings/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783177024",
    "nbf": "1783177024",
    "exp": "1783192084",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAKi8/A8NhZZ93PFnxLuhwYDXi1rFTdM43nSP09F91g0vuuY4fh/32Gk5fhAftbqGURQuBeAChb8s5Vh76gGR9/BtuqJP9O73HNLyE17sTgd891CB/phNIP0PhmDfitOQJjgafTHE0Rg4sWOe7CIqO6A==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "I73cB--4LUynbk58Lw4JAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "jXCr80rgkyIHATRhtB8cxis-u-GQBovvTVgGAZGNTh8BdXNlYXN0LWRzbXM",
    "xms_idrel": "6 1",
    "xms_sub_fct": "3 14",
    "xms_tcdt": "1768616282",
    "correlationid": "f21875c2-5497-47ed-9025-96927b445a2d"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783177024",
    "nbf": "1783177024",
    "exp": "1783192084",
    "aio": "AXQAi/8cAAAAKi8/A8NhZZ93PFnxLuhwYDXi1rFTdM43nSP09F91g0vuuY4fh/32Gk5fhAftbqGURQuBeAChb8s5Vh76gGR9/BtuqJP9O73HNLyE17sTgd891CB/phNIP0PhmDfitOQJjgafTHE0Rg4sWOe7CIqO6A==",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "I73cB--4LUynbk58Lw4JAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "jXCr80rgkyIHATRhtB8cxis-u-GQBovvTVgGAZGNTh8BdXNlYXN0LWRzbXM",
    "xms_idrel": "6 1",
    "xms_sub_fct": "3 14",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "1111111111111111",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "correlationid": "f21875c2-5497-47ed-9025-96927b445a2d"
  },
  "CorrelationId": "f21875c2-5497-47ed-9025-96927b445a2d",
  "EventDataId": "a71c3c98-d314-8c96-66eb-56ade8011247",
  "EventSubmissionTimestamp": "2026-07-04T15:08:04.1210226Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.SECURITY/AUTOPROVISIONINGSETTINGS/WRITE",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Security/autoProvisioningSettings/default",
    "message": "Microsoft.Security/autoProvisioningSettings/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "a71c3c98-d314-8c96-66eb-56ade8011247",
    "eventSubmissionTimestamp": "2026-07-04T15:08:04.1210226Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "default",
    "resourceProviderValue": "MICROSOFT.SECURITY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Security/autoProvisioningSettings/default",
    "message": "Microsoft.Security/autoProvisioningSettings/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "a71c3c98-d314-8c96-66eb-56ade8011247",
    "eventSubmissionTimestamp": "2026-07-04T15:08:04.1210226Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "default",
    "resourceProviderValue": "MICROSOFT.SECURITY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "statusCode": "OK",
    "serviceRequestId": "",
    "activitySubstatusValue": "OK"
  },
  "ResourceProviderValue": "MICROSOFT.SECURITY",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Security/customRecommendations/delete

Namespace: Microsoft.Security

Description

Deletes the custom recommendation

Microsoft.Security/customRecommendations/write

Namespace: Microsoft.Security

Description

Create or update the custom recommendation

Microsoft.Security/datascanners/delete

Namespace: Microsoft.Security

Description

Deletes the datascanners for the scope

Microsoft.Security/datascanners/write

Namespace: Microsoft.Security

Description

Creates or updates the datascanners for the scope

Microsoft.Security/defenderforstoragesettings/delete

Namespace: Microsoft.Security

Description

Deletes the defenderforstoragesettings for the scope

Microsoft.Security/defenderforstoragesettings/write

Namespace: Microsoft.Security

Description

Creates or updates the defenderforstoragesettings for the scope

Microsoft.Security/deviceSecurityGroups/delete

Namespace: Microsoft.Security

Description

Deletes IoT device security groups

Microsoft.Security/deviceSecurityGroups/write

Namespace: Microsoft.Security

Description

Creates or updates IoT device security groups

Microsoft.Security/governanceRules/write

Namespace: Microsoft.Security

Description

Create or update governance rules for managing security posture

Microsoft.Security/informationProtectionPolicies/write

Namespace: Microsoft.Security

Description

Updates the information protection policies for the resource

Microsoft.Security/integration/delete

Namespace: Microsoft.Security

Description

Deleate or update integration on your scope

Microsoft.Security/integration/write

Namespace: Microsoft.Security

Description

Create or update integration on your scope

Microsoft.Security/iotDefenderSettings/delete

Namespace: Microsoft.Security

Description

Deletes IoT Defender Settings

Microsoft.Security/iotDefenderSettings/DownloadManagerActivation/action

Namespace: Microsoft.Security

Description

Download manager activation file with subscription quota data

Microsoft.Security/iotDefenderSettings/PackageDownloads/action

Namespace: Microsoft.Security

Description

Gets downloadable IoT Defender packages information

Microsoft.Security/iotDefenderSettings/write

Namespace: Microsoft.Security

Description

Create or updates IoT Defender Settings

Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts/dismiss/action

Namespace: Microsoft.Security

Description

Dismisses IoT aggregated alerts

Microsoft.Security/iotSecuritySolutions/delete

Namespace: Microsoft.Security

Description

Deletes IoT security solutions

Microsoft.Security/iotSecuritySolutions/write

Namespace: Microsoft.Security

Description

Creates or updates IoT security solutions

Microsoft.Security/iotSensors/delete

Namespace: Microsoft.Security

Description

Deletes IoT Sensors

Microsoft.Security/iotSensors/DownloadActivation/action

Namespace: Microsoft.Security

Description

Downloads activation file for IoT Sensors

Microsoft.Security/iotSensors/DownloadResetPassword/action

Namespace: Microsoft.Security

Description

Downloads reset password file for IoT Sensors

Microsoft.Security/iotSensors/TriggerTiPackageUpdate/action

Namespace: Microsoft.Security

Description

Triggers threat intelligence package update

Microsoft.Security/iotSensors/write

Namespace: Microsoft.Security

Description

Create or updates IoT Sensors

Microsoft.Security/iotSite/delete

Namespace: Microsoft.Security

Description

Deletes IoT site

Microsoft.Security/iotSite/write

Namespace: Microsoft.Security

Description

Creates or updates IoT site

Microsoft.Security/locations/alerts/activate/action

Namespace: Microsoft.Security

Description

Activate a security alert

Microsoft.Security/locations/alerts/dismiss/action

Namespace: Microsoft.Security

Description

Dismiss a security alert

Microsoft.Security/locations/alerts/resolve/action

Namespace: Microsoft.Security

Description

Resolve a security alert

Microsoft.Security/locations/alerts/simulate/action

Namespace: Microsoft.Security

Description

Simulate a security alert

Microsoft.Security/locations/jitNetworkAccessPolicies/delete

Namespace: Microsoft.Security

Description

Deletes the just-in-time network access policy

Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action

Namespace: Microsoft.Security

Description

Initiates a just-in-time network access policy request

Microsoft.Security/locations/jitNetworkAccessPolicies/write

Namespace: Microsoft.Security

Description

Creates a new just-in-time network access policy or updates an existing one

Microsoft.Security/locations/securitySolutions/delete

Namespace: Microsoft.Security

Description

Deletes a security solution

Microsoft.Security/locations/securitySolutions/write

Namespace: Microsoft.Security

Description

Creates a new security solution or updates an existing one

Microsoft.Security/locations/tasks/activate/action

Namespace: Microsoft.Security

Description

Activate a security recommendation

Microsoft.Security/locations/tasks/dismiss/action

Namespace: Microsoft.Security

Description

Dismiss a security recommendation

Microsoft.Security/locations/tasks/resolve/action

Namespace: Microsoft.Security

Description

Resolve a security recommendation

Microsoft.Security/locations/tasks/start/action

Namespace: Microsoft.Security

Description

Start a security recommendation

Microsoft.Security/policies/write

Namespace: Microsoft.Security

Description

Updates the security policy

Microsoft.Security/pricings/action

Namespace: Microsoft.Security

Description

Updates batch of pricing settings for the scope

Microsoft.Security/pricings/delete

Namespace: Microsoft.Security

Description

Deletes the pricing settings for the scope

Microsoft.Security/pricings/securityoperators/delete

Namespace: Microsoft.Security

Description

Deletes the security operators for the scope

Microsoft.Security/pricings/securityoperators/write

Namespace: Microsoft.Security

Description

Updates the security operators for the scope

Microsoft.Security/pricings/write

Namespace: Microsoft.Security

Description

Updates the pricing settings for the scope

Microsoft.Security/privateLinks/delete

Namespace: Microsoft.Security

Description

Deletes a Microsoft Security Private Link.

Microsoft.Security/privateLinks/privateEndpointConnectionProxies/delete

Namespace: Microsoft.Security

Description

Deletes a Microsoft Security Private Endpoint Connection Proxy (NRP only).

Microsoft.Security/privateLinks/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action

Namespace: Microsoft.Security

Description

Updates the properties of the Microsoft Security Private Endpoint Connection Proxy (NRP only).

Microsoft.Security/privateLinks/privateEndpointConnectionProxies/validate/action

Namespace: Microsoft.Security

Description

Validates a Microsoft Security Private Endpoint Connection Proxy object before creation (NRP only).

Microsoft.Security/privateLinks/privateEndpointConnectionProxies/write

Namespace: Microsoft.Security

Description

Creates or updates a Microsoft Security Private Endpoint Connection Proxy (NRP only).

Microsoft.Security/privateLinks/privateEndpointConnections/delete

Namespace: Microsoft.Security

Description

Deletes a Microsoft Security Private Endpoint Connection.

Microsoft.Security/privateLinks/privateEndpointConnections/write

Namespace: Microsoft.Security

Description

Approves or rejects a Microsoft Security Private Endpoint Connection.

Microsoft.Security/privateLinks/write

Namespace: Microsoft.Security

Description

Creates or updates a Microsoft Security Private Link.

Microsoft.Security/register/action

Namespace: Microsoft.Security

Description

Registers the subscription for Azure Security Center

Microsoft.Security/securityConnectors/delete

Namespace: Microsoft.Security

Description

Deletes the security connector

Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/projects/repos/write

Namespace: Microsoft.Security

Description

Creates or updates a monitored Azure DevOps repository resource.

Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/projects/write

Namespace: Microsoft.Security

Description

Creates or updates a monitored Azure DevOps project resource.

Microsoft.Security/securityConnectors/devops/azureDevOpsOrgs/write

Namespace: Microsoft.Security

Description

Creates or updates monitored Azure DevOps organization details.

Microsoft.Security/securityConnectors/devops/delete

Namespace: Microsoft.Security

Description

Deletes a DevOps Connector.

Microsoft.Security/securityConnectors/devops/gitHubOwners/repos/issues/action

Namespace: Microsoft.Security

Description

Creates a GitHub issue for the specified repository and assessment.

Microsoft.Security/securityConnectors/devops/gitLabGroups/listSubgroups/action

Namespace: Microsoft.Security

Description

Gets nested subgroups of given GitLab Group which are onboarded to the connector.

Microsoft.Security/securityConnectors/devops/listAvailableAzureDevOpsOrgs/action

Namespace: Microsoft.Security

Description

Returns a list of all Azure DevOps organizations accessible by the user token consumed by the connector.

Microsoft.Security/securityConnectors/devops/listAvailableGitHubOwners/action

Namespace: Microsoft.Security

Description

Returns a list of all GitHub owners accessible by the user token consumed by the connector.

Microsoft.Security/securityConnectors/devops/listAvailableGitLabGroups/action

Namespace: Microsoft.Security

Description

Returns a list of all GitLab groups accessible by the user token consumed by the connector.

Microsoft.Security/securityConnectors/devops/write

Namespace: Microsoft.Security

Description

Creates or updates a DevOps Configuration.

Microsoft.Security/securityConnectors/write

Namespace: Microsoft.Security

Description

Updates the security connector

Microsoft.Security/securityContacts/delete

Namespace: Microsoft.Security

Description

Deletes the security contact

Microsoft.Security/securityContacts/write

Namespace: Microsoft.Security

Description

Updates the security contact

Microsoft.Security/securityoperators/delete

Namespace: Microsoft.Security

Description

Deletes the securityoperators for the scope

Microsoft.Security/securityoperators/write

Namespace: Microsoft.Security

Description

Creates or updates the securityoperators for the scope

Microsoft.Security/securitySolutions/delete

Namespace: Microsoft.Security

Description

Deletes a security solution

Microsoft.Security/securitySolutions/write

Namespace: Microsoft.Security

Description

Creates a new security solution or updates an existing one

Microsoft.Security/securityStandards/delete

Namespace: Microsoft.Security

Description

Deletes the security standard

Microsoft.Security/securityStandards/write

Namespace: Microsoft.Security

Description

Create or update the security standard

Microsoft.Security/sensitivitySettings/write

Namespace: Microsoft.Security

Description

Updates tenant level sensitivity settings

Microsoft.Security/serverVulnerabilityAssessments/delete

Namespace: Microsoft.Security

Description

Remove a server vulnerability assessments solution from a resource

Microsoft.Security/serverVulnerabilityAssessments/write

Namespace: Microsoft.Security

Description

Create or update a server vulnerability assessments solution on resource

Microsoft.Security/serverVulnerabilityAssessmentsSettings/delete

Namespace: Microsoft.Security

Description

Remove server vulnerability assessments settings from a given subscription

Microsoft.Security/serverVulnerabilityAssessmentsSettings/write

Namespace: Microsoft.Security

Description

Create or update server vulnerability assessments settings on a given subscription

Microsoft.Security/settings/write

Namespace: Microsoft.Security

Description

Updates the settings for the scope

Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/action

Namespace: Microsoft.Security

Description

Add a list of rules result to the baseline.

Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/delete

Namespace: Microsoft.Security

Description

Remove the rule result from the baseline.

Microsoft.Security/sqlVulnerabilityAssessments/baselineRules/write

Namespace: Microsoft.Security

Description

Change the rule baseline result.

Microsoft.Security/sqlVulnerabilityAssessments/delete

Namespace: Microsoft.Security

Description

Delete SQL Vulnerability Assessment settings.

Microsoft.Security/sqlVulnerabilityAssessments/write

Namespace: Microsoft.Security

Description

Create or update SQL Vulnerability Assessment settings.

Microsoft.Security/standardAssignments/delete

Namespace: Microsoft.Security

Description

Deletes the standard assignment

Microsoft.Security/standardAssignments/write

Namespace: Microsoft.Security

Description

Create or update the standard assignment

Microsoft.Security/standards/delete

Namespace: Microsoft.Security

Description

Deletes the security standard

Microsoft.Security/standards/write

Namespace: Microsoft.Security

Description

Create or update the security standard

Microsoft.Security/unregister/action

Namespace: Microsoft.Security

Description

Unregisters the subscription from Azure Security Center

Microsoft.Security/webApplicationFirewalls/delete

Namespace: Microsoft.Security

Description

Deletes a web application firewall

Microsoft.Security/webApplicationFirewalls/write

Namespace: Microsoft.Security

Description

Creates a new web application firewall or updates an existing one

Microsoft.Security/workspaceSettings/connect/action

Namespace: Microsoft.Security

Description

Change workspace settings reconnection settings

Microsoft.Security/workspaceSettings/delete

Namespace: Microsoft.Security

Description

Deletes the workspace settings

Microsoft.Security/workspaceSettings/write

Namespace: Microsoft.Security

Description

Updates the workspace settings