Entra-AuditLogs

88 operations, identified by OperationName in the audit log.

OperationName	Description
_catch_all	Any Microsoft Entra ID directory audit operation recorded in the AuditLogs table (no specific OperationName filter).
Add app role assignment grant to user	An app role was assigned to a user.
Add app role assignment to service principal	An application (app-only) role assignment was granted to a service principal.
Add application	An application registration was created.
Add conditional access policy	A Conditional Access policy was created.
Add delegated permission grant	An OAuth2 delegated permission grant was created for an application.
Add device	A device object was added to the directory.
Add eligible member (eligible)	A principal was assigned eligible for a role through PIM.
Add eligible member (permanent)	A principal was assigned a permanent eligible role through PIM.
Add eligible member to role	A principal was made eligible for a directory role via PIM.
Add eligible member to role in PIM completed (permanent)	A permanent PIM role-eligibility assignment completed.
Add group	A new group was created.
Add member to group	A principal was added as a member of a group (including role-assignable groups).
Add member to role	A principal was added as a permanent member of a directory role (privileged role assignment).
Add member to role completed (PIM activation)	A PIM-eligible role activation completed, granting the role for the activation window.
Add member to role in PIM completed (timebound)	A time-bound PIM role assignment completed.
Add member to role in PIM requested (permanent)	A permanent PIM role assignment was requested.
Add member to role outside of PIM (permanent)	A permanent directory-role assignment was made directly, bypassing PIM (no just-in-time activation).
Add member to role request denied (PIM activation)	A PIM role activation request was denied.
Add named location	A named location (IP range) was created for Conditional Access.
Add OAuth2PermissionGrant	An OAuth2 delegated permission grant was created.
Add owner to application	An owner was added to an application registration.
Add owner to group	An owner was added to a group.
Add owner to service principal	An owner was added to a service principal.
Add registered owner to device	A registered owner was added to a device.
Add registered users to device	Registered users were added to a device.
Add role definition	A custom directory role definition was created.
Add service principal	A service principal (enterprise application instance) was created.
Add service principal credentials	Credentials were added to a service principal (common persistence technique).
Add unverified domain	An unverified custom domain was added to the tenant.
Add user	A new user account was created in the directory.
Add verified domain	A verified custom domain was added to the tenant.
Admin deleted security info	An admin removed a user's security info.
Admin registered security info	An admin registered security info on behalf of a user (e.g. Temporary Access Pass).
Admin updated security info	An admin modified a user's security info.
Assigns the caller to user access admin	A Global Administrator elevated access to User Access Administrator over Azure resources.
Authentication Methods Policy Update	The tenant authentication-methods policy was changed.
Bulk invite users - started (bulk)	A bulk guest-invite operation was started.
Change user password	A user changed their own password.
Consent to application	Admin or user consent was granted to an application (illicit-consent-grant target).
Delete application	An application registration was deleted.
Delete conditional access policy	A Conditional Access policy was deleted.
Delete device	A device object was deleted.
Delete group	A group was deleted.
Delete user	A user account was deleted.
Disable account	A user account was disabled.
Disable Strong Authentication	Strong authentication (MFA) was disabled for a user.
Enable account	A user account was enabled.
Hard Delete application	An application registration was permanently deleted (purged from the deleted-items store, not recoverable).
Invite external user	A guest (B2B) user was invited to the tenant.
Invite external user with reset invitation status	A guest user invitation was re-sent/reset.
Read BitLocker key	A BitLocker recovery key was read from the directory.
Redeem external user invite	A guest user redeemed their B2B invitation.
Register device	A device was registered or joined to Entra ID.
Remove member from group	A principal was removed from a group.
Remove member from role	A principal was removed from a directory role.
Remove service principal	A service principal was removed.
Remove service principal credentials	Credentials were removed from a service principal.
Reset user password	An administrator reset a user's password.
Restore application	A soft-deleted application registration was restored.
Restore user	A soft-deleted user account was restored.
Risky user	A user was flagged as risky by Identity Protection.
Set Company Information	Tenant company branding/information was changed.
Set device registration policies	Device registration policies were changed.
Set DirSyncEnabled flag	Directory synchronization was enabled or disabled for the tenant.
Set domain authentication	A domain's authentication type was changed (managed vs federated).
Set federation settings on domain	Federation settings on a domain were changed (federated-trust backdoor technique).
Set force change user password	A user was flagged to change password at next sign-in.
Suspicious activity reported	Suspicious activity was reported for a user (e.g. MFA fraud report).
Update application	An application registration was modified.
Update Application - Certificates and secrets management	Credentials (certificate or client secret) were added or changed on an application.
Update conditional access policy	A Conditional Access policy was modified (tampering can weaken enforcement).
Update device	A device object was modified.
Update group	A group's properties were modified.
Update named location	A named location was modified.
Update role definition	A custom directory role definition was modified.
Update role setting in PIM	PIM role settings (activation duration, approval, MFA requirement) were changed.
Update StsRefreshTokenValidFrom Timestamp	A user's refresh tokens were invalidated (revoke sessions); also set silently by some attacks.
Update user	A user account attribute was modified.
Update User Risk and MFA Registration Policy	The user-risk or MFA-registration policy was changed.
User changed default security info	A user changed their default authentication method.
User deleted security info	A user removed one of their authentication methods.
User has elevated their access to User Access Administrator for their Azure Resources	A Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).
User registered security info	A user registered an authentication method (MFA/SSPR security info).
User reviewed security info	A user reviewed their registered security info.
User Risk Detection	Identity Protection raised a user-risk detection.
Verify domain	A custom domain was verified.
Verify email verified domain	An email-verified domain was verified.

_catch_all: Entra ID audit event (any operation)

Provider: Entra-AuditLogs

Description

Any Microsoft Entra ID directory audit operation recorded in the AuditLogs table (no specific OperationName filter).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`RoleManagement`	8 rules	kusto, sigma
`Result`	eq	`success`	8 rules	kusto
`key`	eq	`User-Agent`	6 rules	kusto
`type`	eq	`Policy`	6 rules	kusto
`AADOperationType`	in	`Assign`	5 rules	kusto
`AADOperationType`	in	`AssignEligibleRole`	4 rules	kusto
`OperationName`	contains	`certificates and secrets management`	5 rules	kusto
`OperationName`	contains	`add service principal`	4 rules	kusto
`OperationName`	contains	`update a partner cross-tenant access setting`	4 rules	kusto
`azure_ad::activity_display_name`	contains	`add eligible member to role`	5 rules	kusto
`azure_ad::activity_display_name`	contains	`add member to role`	5 rules	kusto
`displayName`	contains	`@`	5 rules	kusto
`displayName`	eq	`KeyDescription`	5 rules	kusto
`displayName`	eq	`Role.DisplayName`	5 rules	kusto
`userPrincipalName`	contains	`@`	5 rules	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Sign-in BloodHound Suite User-Agent Detected source medium: Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.
Entra ID Kali365 Default User-Agent Detected source high: Identifies the default user agent string associated with Kali365 (also referred to as Kali365 Live), a phishing-as-a-service (PhaaS) platform that automates OAuth 2.0 device code phishing and adversary-in-the-middle (AiTM) session capture against Microsoft 365 and Microsoft Entra ID. The Kali365 Electron desktop client identifies itself with the user agent kali365-live/1.0.0 when polling for and replaying captured OAuth tokens, so its appearance in Entra ID sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log indicates that an attacker-controlled Kali365 client is interacting with the tenant using stolen tokens. Unlike dual-use offensive tooling, Kali365 is a criminal service with no legitimate enterprise use, making this user agent a high-fidelity indicator of active account compromise.

Kusto #

Application ID URI Changed source medium: Detects changes to an Application ID URI. Monitor these changes to make sure that they were authorized. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#appid-uri-added-modified-or-removed
Changes to Application Logout URL source low: Detects changes to an applications sign out URL. Look for any modifications to a sign out URL. Blank entries or entries to non-existent locations would stop a user from terminating a session. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#logout-url-modified-or-removed
Conditional Access Policy Modified by New User source medium: Detects a Conditional Access Policy being modified by a user who has not modified a policy in the last 14 days. A threat actor may try to modify policies to weaken the security controls in place. Investigate any change to ensure they are approved. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access

Show 17 more (27 total)

End-user consent stopped due to risk-based consent source medium: Detects a user's consent to an OAuth application being blocked due to it being too risky. These events should be investigated to understand why the user attempted to consent to the applicaiton and what other applicaitons they may have consented to. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#end-user-stopped-due-to-risk-based-consent
Service Principal Assigned Privileged Role source medium: Detects a privileged role being added to a Service Principal. Ensure that any assignment to a Service Principal is valid and appropriate - Service Principals should not be assigned to very highly privileged roles such as Global Admin. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts
Detect PIM Alert Disabling activity source medium: Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in Microsoft Entra ID (Azure AD) organization. This query will help detect attackers attempts to disable in product PIM alerts which are associated with Azure MFA requirements and could indicate activation of privileged access
Privileged Account Permissions Changed source medium: Detects changes to permissions assigned to admin users. Threat actors may try and increase permission scope by adding additional roles to already privileged accounts. Review any modifications to ensure they were made legitimately. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts
Power Platform - Account added to privileged Microsoft Entra roles source low: Identifies changes to privileged directory roles impacting Power Platform: - Dynamics 365 Admins - Power Platform Admins - Fabric Admins
Bulk Changes to Privileged Account Permissions source high: Identifies when changes to multiple users permissions are changed at once. Investigate immediately if not a planned change. This setting could enable an attacker access to Azure subscriptions in your environment. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-identity-management
Cross-tenant Access Settings Organization Added source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when an Organization is added other than the list that is supposed to exist from the Microsoft Entra ID Cross-tenant Access Settings.
Cross-tenant Access Settings Organization Deleted source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when an Organization is deleted from the Microsoft Entra ID Cross-tenant Access Settings.
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Inbound Collaboration Settings are changed for "Users & Groups" and for "Applications".
Cross-tenant Access Settings Organization Inbound Direct Settings Changed source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Inbound Direct Settings are changed for "Users & Groups" and for "Applications".
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Outbound Collaboration Settings are changed for "Users & Groups" and for "Applications".
Cross-tenant Access Settings Organization Outbound Direct Settings Changed source medium: Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Outbound Direct Settings are changed for "Users & Groups" and for "Applications".
First access credential added to Application or Service Principal where no credential was present source high: This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where there was no previous verify KeyCredential associated. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential. Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.
Mail.Read Permissions Granted to Application source medium: This query look for applications that have been granted (Delegated or App/Role) permissions to Read Mail (Permissions field has Mail.Read) and subsequently has been consented to. This can help identify applications that have been abused to gain access to mailboxes.
Multiple admin membership removals from newly created admin. source medium: This query detects when newly created Global admin removes multiple existing global admins which can be an attempt by adversaries to lock down organization and retain sole access. Investigate reasoning and intention of multiple membership removal by new Global admins and take necessary actions accordingly.
NRT New access credential added to Application or Service Principal source medium: This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where a verify KeyCredential was already present for the app. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential. Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.
New access credential added to Application or Service Principal source medium: This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where a verify KeyCredential was already present for the app. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential. Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add app role assignment grant to user

Provider: Entra-AuditLogs

Description

An app role was assigned to a user.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add app role assignment to service principal

Provider: Entra-AuditLogs

Description

An application (app-only) role assignment was granted to a service principal.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`ApplicationManagement`	2 rules	kusto
`Category`	eq	`RoleManagement`	1 rule	kusto, sigma
`OperationName`	contains	`certificates and secrets management`	1 rule	kusto
`OperationName`	contains	`update application`	1 rule	kusto
`OperationName`	eq	`Add app role assignment to service principal`	2 rules	kusto
`PermissionGrant`	contains	`rolemanagement.readwrite.directory`	2 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	2 rules	kusto, sigma
`displayName`	eq	`AppRole.Value`	2 rules	kusto
`displayName`	eq	`ServicePrincipal.DisplayName`	2 rules	kusto
`displayName`	eq	`ServicePrincipal.ObjectID`	2 rules	kusto
`displayName`	eq	`DelegatedPermissionGrant.Scope`	1 rule	kusto
`displayName`	is_not_null		1 rule	kusto
`TargetResources_0_modifiedProperties`	is_not_null		1 rule	kusto
`azure_ad::activity_display_name`	eq	`Add service principal`	1 rule	elastic, kusto
`azure_ad::modified_properties_new`	gt	`0`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Service Principal Assigned App Role With Sensitive Access source medium: Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read. A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions. Ensure that any assignment to a Service Principal is valid and appropriate. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions
Admin promotion after Role Management Application Permission Grant source high: This rule looks for a service principal being granted the Microsoft Graph RoleManagement.ReadWrite.Directory (application) permission before being used to add an Microsoft Entra ID object or user account to an Admin directory role (i.e. Global Administrators). This is a known attack path that is usually abused when a service principal already has the AppRoleAssignment.ReadWrite.All permission granted. This permission allows an app to manage permission grants for application permissions to any API. A service principal can promote itself or other service principals to admin roles (i.e. Global Administrators). This would be considered a privilege escalation technique. Ref : https://docs.microsoft.com/graph/permissions-reference#role-management-permissions, https://docs.microsoft.com/graph/api/directoryrole-post-members?view=graph-rest-1.0&tabs=http
Microsoft Entra ID Role Management Permission Grant source high: Identifies when the Microsoft Graph RoleManagement.ReadWrite.Directory (Delegated or Application) permission is granted to a service principal. This permission allows an application to read and manage the role-based access control (RBAC) settings for your company's directory. An adversary could use this permission to add an Microsoft Entra ID object to an Admin directory role and escalate privileges. Ref : https://docs.microsoft.com/graph/permissions-reference#role-management-permissions Ref : https://docs.microsoft.com/graph/api/directoryrole-post-members?view=graph-rest-1.0&tabs=http↳ also matches Add delegated permission grant

Show 1 more (4 total)

Suspicious Service Principal creation activity source low: This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes)↳ also matches Add service principal, Remove service principal

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add application

Provider: Entra-AuditLogs

Description

An application registration was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Application Creation source: Application creation can be legitimate but aren't frequently created. Validating application creation may be appropriate to ensure rogue apps aren't being created.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add conditional access policy

Provider: Entra-AuditLogs

Description

A Conditional Access policy was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

Conditional Access - A new Conditional Access policy was created source informational: A new Conditional Access policy was created in Entra ID.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add delegated permission grant

Provider: Entra-AuditLogs

Description

An OAuth2 delegated permission grant was created for an application.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`ApplicationManagement`	4 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	4 rules	kusto, sigma
`azure_ad::modified_properties_new`	contains	`addresstype`	3 rules	kusto
`azure_ad::modified_properties_new`	gt	`0`	4 rules	kusto
`displayName`	eq	`AppAddress`	3 rules	kusto
`displayName`	eq	`ConsentAction.Permissions`	3 rules	kusto
`displayName`	is_not_null		4 rules	kusto
`type`	eq	`ServicePrincipal`	4 rules	kusto
`GrantConsentType`	ne	`AllPrincipals`	3 rules	kusto
`OperationName`	eq	`Add OAuth2PermissionGrant`	3 rules	kusto
`OperationName`	eq	`Add delegated permission grant`	3 rules	kusto
`OperationName`	eq	`Add service principal`	3 rules	kusto
`OperationName`	eq	`Consent to application`	3 rules	kusto
`ConsentFull`	contains	`files.read`	2 rules	kusto
`ConsentFull`	contains	`files.read.all`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Microsoft Entra ID Role Management Permission Grant source high: Identifies when the Microsoft Graph RoleManagement.ReadWrite.Directory (Delegated or Application) permission is granted to a service principal. This permission allows an application to read and manage the role-based access control (RBAC) settings for your company's directory. An adversary could use this permission to add an Microsoft Entra ID object to an Admin directory role and escalate privileges. Ref : https://docs.microsoft.com/graph/permissions-reference#role-management-permissions Ref : https://docs.microsoft.com/graph/api/directoryrole-post-members?view=graph-rest-1.0&tabs=http↳ also matches Add app role assignment to service principal
Suspicious application consent similar to O365 Attack Toolkit source high: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the MDSec O365 Attack Toolkit (https://github.com/mdsecactivebreach/o365-attack-toolkit). The default permissions/scope for the MDSec O365 Attack toolkit change sometimes but often include contacts.read, user.read, mail.read, notes.read.all, mailboxsettings.readwrite, files.readwrite.all, mail.send, files.read, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add OAuth2PermissionGrant, Add service principal, Consent to application
Suspicious application consent similar to PwnAuth source medium: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the FireEye PwnAuth toolkit (https://github.com/fireeye/PwnAuth). The default permissions/scope for the PwnAuth toolkit are user.read, offline_access, mail.readwrite, mail.send, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add OAuth2PermissionGrant, Add service principal, Consent to application

Show 1 more (4 total)

Suspicious application consent for offline access source low: This will alert when a user consents to provide a previously-unknown Azure application with offline access via OAuth. Offline access will provide the Azure App with access to the listed resources without requiring two-factor authentication. Consent to applications with offline access and read capabilities should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add OAuth2PermissionGrant, Add service principal, Consent to application

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add device

Provider: Entra-AuditLogs

Description

A device object was added to the directory.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Device Registration with ROADtools Default OS Build source medium: Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19041.928" and the device display name follows the default "DESKTOP-" pattern. This combination is the default device profile that ROADtools (roadtx) uses when registering a device, and it is uncommon for the OS build to match the hardcoded value across an environment of otherwise patched hosts. Adversaries register rogue devices in Entra ID to acquire a Primary Refresh Token (PRT), establish persistence, and obtain trusted, programmatic access to the tenant. Because the OS build is a tool default, this is a high-fidelity but evadable indicator; baseline approved provisioning tooling and device naming conventions before relying on it.
Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.↳ also matches Add registered owner to device, Add registered users to device

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add eligible member (eligible)

Provider: Entra-AuditLogs

Description

A principal was assigned eligible for a role through PIM.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	in	`Add member to role`	1 rule	kusto
`RoleName`	contains	`admin`	1 rule	kusto
`displayName`	eq	`Role.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

User Added to Admin Role source low: Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts↳ also matches Add eligible member (permanent), Add member to role

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add eligible member (permanent)

Provider: Entra-AuditLogs

Description

A principal was assigned a permanent eligible role through PIM.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	in	`Add member to role`	1 rule	kusto
`RoleName`	contains	`admin`	1 rule	kusto
`displayName`	eq	`Role.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

User Added to Admin Role source low: Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts↳ also matches Add eligible member (eligible), Add member to role

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add eligible member to role

Provider: Entra-AuditLogs

Description

A principal was made eligible for a directory role via PIM.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`RoleManagement`	2 rules	kusto, sigma
`GroupName`	in	`PrivilegedAuthenticationAdmins`	2 rules	kusto
`GroupName`	in	`PrivilegedRoleAdmins`	2 rules	kusto
`GroupName`	in	`TenantAdmins`	2 rules	kusto
`GroupName`	in	`UserAccountAdmins`	2 rules	kusto
`OperationName`	in	`Add eligible member to role`	2 rules	kusto
`OperationName`	in	`Add member to role`	2 rules	kusto
`displayName`	eq	`Role.WellKnownObjectName`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

NRT User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add member to role
User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add member to role

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add eligible member to role in PIM completed (permanent)

Provider: Entra-AuditLogs

Description

A permanent PIM role-eligibility assignment completed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.category`	eq	`RoleManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Global Administrator Role Assigned (PIM User) source high: Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization.↳ also matches Add member to role in PIM completed (timebound)

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add group

Provider: Entra-AuditLogs

Description

A new group was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to group

Provider: Entra-AuditLogs

Description

A principal was added as a member of a group (including role-assignable groups).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Guest accounts added in Entra ID Groups other than the ones specified source high: Guest Accounts are added in the Organization Tenants to perform various tasks i.e projects execution, support etc.. This detection notifies when guest users are added to Microsoft Entra ID Groups other than the ones specified and poses a risk to gain access to sensitive apps or data.↳ also matches Add owner to group
Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add named location, Delete conditional access policy, Remove member from group, Update conditional access policy, Update named location

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role

Provider: Entra-AuditLogs

Description

A principal was added as a permanent member of a directory role (privileged role assignment).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`RoleManagement`	5 rules	kusto, sigma
`type`	eq	`User`	5 rules	kusto
`OperationName`	contains	`add member to role outside of pim`	2 rules	kusto
`OperationName`	eq	`Add member to role`	2 rules	kusto
`OperationName`	in	`Add member to role`	4 rules	kusto
`OperationName`	in	`Add eligible member to role`	2 rules	kusto
`GroupName`	in	`PrivilegedRoleAdmins`	3 rules	kusto
`GroupName`	in	`TenantAdmins`	3 rules	kusto
`GroupName`	in	`UserAccountAdmins`	3 rules	kusto
`GroupName`	in	`PrivilegedAuthenticationAdmins`	2 rules	kusto
`displayName`	eq	`Role.WellKnownObjectName`	3 rules	kusto
`Identity`	ne	`MS-PIM`	2 rules	kusto
`Identity`	ne	`MS-PIM-Fairfax`	2 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	2 rules	kusto, sigma
`RoleName`	contains	`admin`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Global Administrator Role Assigned source high: In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Microsoft Entra ID and services that use Microsoft Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. They can also elevate privilege to User Access Administrator to pivot into Azure resources.

Kusto #

User Added to Admin Role source low: Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts↳ also matches Add eligible member (eligible), Add eligible member (permanent)
NRT Privileged Role Assigned Outside PIM source low: Identifies a privileged role being assigned to a user outside of PIM Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1
Privileged Role Assigned Outside PIM source low: Identifies a privileged role being assigned to a user outside of PIM Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1

Show 3 more (6 total)

NRT User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add eligible member to role
User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add eligible member to role
Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add member to role in PIM requested (permanent)

YARA-L #

Entra ID Add User To Admin Role source: Adding users to administrative roles is needed but due to sensitivity of these roles, validation should occur when this occurs
Entra ID Recently Created User Assigned an Entra ID Role source: Detect users who are newly created and then immediately assigned administrator level roles↳ also matches Add user

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role completed (PIM activation)

Provider: Entra-AuditLogs

Description

A PIM-eligible role activation completed, granting the role for the activation window.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

Account Elevated to New Role source medium: Detects an account that is elevated to a new role where that account has not had that role in the last 14 days. Role elevations are a key mechanism for gaining permissions, monitoring which users have which roles, and for anomalies in those roles is useful for finding suspicious activity. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role in PIM completed (timebound)

Provider: Entra-AuditLogs

Description

A time-bound PIM role assignment completed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.category`	eq	`RoleManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Global Administrator Role Assigned (PIM User) source high: Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization.↳ also matches Add eligible member to role in PIM completed (permanent)

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role in PIM requested (permanent)

Provider: Entra-AuditLogs

Description

A permanent PIM role assignment was requested.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`RoleManagement`	1 rule	kusto, sigma
`GroupName`	in	`PrivilegedRoleAdmins`	1 rule	kusto
`GroupName`	in	`TenantAdmins`	1 rule	kusto
`GroupName`	in	`UserAccountAdmins`	1 rule	kusto
`OperationName`	in	`Add member to role`	1 rule	kusto
`displayName`	eq	`Role.WellKnownObjectName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups source medium: This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities. For Administrator role permissions in Microsoft Entra ID please see https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles↳ also matches Add member to role

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role outside of PIM (permanent)

Provider: Entra-AuditLogs

Description

A permanent directory-role assignment was made directly, bypassing PIM (no just-in-time activation).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Add User Outside PIM source: Adding users to roles is expected but if it occurs outside of PIM, validation should occur

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add member to role request denied (PIM activation)

Provider: Entra-AuditLogs

Description

A PIM role activation request was denied.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::activity_display_name`	eq	`Add member to role request denied (PIM activation)`	2 rules	kusto
`type`	eq	`Role`	2 rules	kusto
`user`	is_not_null		2 rules	elastic, kusto, splunk

Detection Rules #

View all rules referencing this event →

Kusto #

NRT PIM Elevation Request Rejected source high: Identifies when a user is rejected for a privileged role elevation via PIM. Monitor rejections for indicators of attacker compromise of the requesting account. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-identity-management
PIM Elevation Request Rejected source high: Identifies when a user is rejected for a privileged role elevation via PIM. Monitor rejections for indicators of attacker compromise of the requesting account. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-identity-management

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add named location

Provider: Entra-AuditLogs

Description

A named location (IP range) was created for Conditional Access.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add member to group, Delete conditional access policy, Remove member from group, Update conditional access policy, Update named location

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add OAuth2PermissionGrant

Provider: Entra-AuditLogs

Description

An OAuth2 delegated permission grant was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`ApplicationManagement`	3 rules	kusto
`GrantConsentType`	ne	`AllPrincipals`	3 rules	kusto
`OperationName`	eq	`Add OAuth2PermissionGrant`	3 rules	kusto
`OperationName`	eq	`Add delegated permission grant`	3 rules	kusto
`OperationName`	eq	`Add service principal`	3 rules	kusto
`OperationName`	eq	`Consent to application`	3 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	3 rules	kusto, sigma
`azure_ad::modified_properties_new`	contains	`addresstype`	3 rules	kusto
`azure_ad::modified_properties_new`	gt	`0`	3 rules	kusto
`displayName`	eq	`AppAddress`	3 rules	kusto
`displayName`	eq	`ConsentAction.Permissions`	3 rules	kusto
`displayName`	is_not_null		3 rules	kusto
`type`	eq	`ServicePrincipal`	3 rules	kusto
`ConsentFull`	contains	`files.read`	2 rules	kusto
`ConsentFull`	contains	`files.read.all`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Suspicious application consent similar to O365 Attack Toolkit source high: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the MDSec O365 Attack Toolkit (https://github.com/mdsecactivebreach/o365-attack-toolkit). The default permissions/scope for the MDSec O365 Attack toolkit change sometimes but often include contacts.read, user.read, mail.read, notes.read.all, mailboxsettings.readwrite, files.readwrite.all, mail.send, files.read, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add service principal, Consent to application
Suspicious application consent similar to PwnAuth source medium: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the FireEye PwnAuth toolkit (https://github.com/fireeye/PwnAuth). The default permissions/scope for the PwnAuth toolkit are user.read, offline_access, mail.readwrite, mail.send, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add service principal, Consent to application
Suspicious application consent for offline access source low: This will alert when a user consents to provide a previously-unknown Azure application with offline access via OAuth. Offline access will provide the Azure App with access to the listed resources without requiring two-factor authentication. Consent to applications with offline access and read capabilities should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add service principal, Consent to application

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add owner to application

Provider: Entra-AuditLogs

Description

An owner was added to an application registration.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`ApplicationManagement`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID User Added as Registered Application Owner source low: Identifies when a user is added as an owner for an Azure application. An adversary may add a user account as an owner for an Azure application in order to grant additional permissions and modify the application's configuration using another account.

Kusto #

Changes to Application Ownership source medium: Detects changes to the ownership of an appplicaiton. Monitor these changes to make sure that they were authorized. Ref: https://learn.microsoft.com/en-gb/entra/architecture/security-operations-applications#new-owner

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add owner to group

Provider: Entra-AuditLogs

Description

An owner was added to a group.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Guest accounts added in Entra ID Groups other than the ones specified source high: Guest Accounts are added in the Organization Tenants to perform various tasks i.e projects execution, support etc.. This detection notifies when guest users are added to Microsoft Entra ID Groups other than the ones specified and poses a risk to gain access to sensitive apps or data.↳ also matches Add member to group

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add owner to service principal

Provider: Entra-AuditLogs

Description

An owner was added to a service principal.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID User Added as Service Principal Owner source low: Identifies when a user is added as an owner for an Azure service principal. The service principal object defines what the application can do in the specific tenant, who can access the application, and what resources the app can access. A service principal object is created when an application is given permission to access resources in a tenant. An adversary may add a user account as an owner for a service principal and use that account in order to define what an application can do in the Azure AD tenant.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add registered owner to device

Provider: Entra-AuditLogs

Description

A registered owner was added to a device.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.↳ also matches Add device, Add registered users to device

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add registered users to device

Provider: Entra-AuditLogs

Description

Registered users were added to a device.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.↳ also matches Add device, Add registered owner to device

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add role definition

Provider: Entra-AuditLogs

Description

A custom directory role definition was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add service principal

Provider: Entra-AuditLogs

Description

A service principal (enterprise application instance) was created.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`ApplicationManagement`	3 rules	kusto
`GrantConsentType`	ne	`AllPrincipals`	3 rules	kusto
`OperationName`	eq	`Add OAuth2PermissionGrant`	3 rules	kusto
`OperationName`	eq	`Add delegated permission grant`	3 rules	kusto
`OperationName`	eq	`Add service principal`	3 rules	kusto
`OperationName`	eq	`Consent to application`	3 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	3 rules	kusto, sigma
`azure_ad::modified_properties_new`	contains	`addresstype`	3 rules	kusto
`azure_ad::modified_properties_new`	gt	`0`	3 rules	kusto
`displayName`	eq	`AppAddress`	3 rules	kusto
`displayName`	eq	`ConsentAction.Permissions`	3 rules	kusto
`displayName`	is_not_null		3 rules	kusto
`type`	eq	`ServicePrincipal`	3 rules	kusto
`ConsentFull`	contains	`files.read`	2 rules	kusto
`ConsentFull`	contains	`files.read.all`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Service Principal Created source low: Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity.

Kusto #

Suspicious application consent similar to O365 Attack Toolkit source high: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the MDSec O365 Attack Toolkit (https://github.com/mdsecactivebreach/o365-attack-toolkit). The default permissions/scope for the MDSec O365 Attack toolkit change sometimes but often include contacts.read, user.read, mail.read, notes.read.all, mailboxsettings.readwrite, files.readwrite.all, mail.send, files.read, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add OAuth2PermissionGrant, Consent to application
Suspicious application consent similar to PwnAuth source medium: This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the FireEye PwnAuth toolkit (https://github.com/fireeye/PwnAuth). The default permissions/scope for the PwnAuth toolkit are user.read, offline_access, mail.readwrite, mail.send, and files.read.all. Consent to applications with these permissions should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add OAuth2PermissionGrant, Consent to application
Suspicious application consent for offline access source low: This will alert when a user consents to provide a previously-unknown Azure application with offline access via OAuth. Offline access will provide the Azure App with access to the listed resources without requiring two-factor authentication. Consent to applications with offline access and read capabilities should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Add delegated permission grant, Add OAuth2PermissionGrant, Consent to application

Show 1 more (4 total)

Suspicious Service Principal creation activity source low: This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes)↳ also matches Add app role assignment to service principal, Remove service principal

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add service principal credentials

Provider: Entra-AuditLogs

Description

Credentials were added to a service principal (common persistence technique).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Consent to application`	1 rule	kusto
`displayName`	eq	`ConsentAction.Permissions`	1 rule	kusto
`displayName`	eq	`Included Updated Properties`	1 rule	kusto
`displayName`	eq	`KeyDescription`	1 rule	kusto
`displayName`	eq	`TargetId.ServicePrincipalNames`	1 rule	kusto
`type`	eq	`ServicePrincipal`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Service Principal Credentials Created by Unusual User source medium: Identifies when new Service Principal credentials have been added in Microsoft Entra ID. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements.

Kusto #

Credential added after admin consented to Application source medium: This query will identify instances where Service Principal credentials were added to an application by one user after the application was granted admin consent rights by another user. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential. Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities↳ also matches Consent to application

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add unverified domain

Provider: Entra-AuditLogs

Description

An unverified custom domain was added to the tenant.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Result`	eq	`success`	2 rules	kusto
`ResultType`	eq	`0`	1 rule	kusto, sigma
`azure.auditlogs.properties.category`	eq	`DirectoryManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Custom Domain Added or Verified source low: Detects when a custom domain is added or verified in an Entra ID tenant. Adding and verifying a custom domain are precursor steps to configuring domain federation, which can be abused by adversaries to route authentication through an attacker-controlled identity provider (Golden SAML). In most organizations, custom domains are added infrequently and these events should be investigated to ensure they are part of a legitimate administrative workflow.↳ also matches Verify domain

Kusto #

Possible SignIn from Azure Backdoor source medium: Identifies when a user adds an unverified domain as an authentication method, followed by a sign-in from a user the newly added domain. Threat actors may add custom domains to create a backdoor to your tenant. It's important to monitor whenever custom domains are added to the tenant.
New onmicrosoft domain added to tenant source medium: This detection looks for new onmicrosoft domains being added to a tenant. An attacker who compromises a tenant may register a new onmicrosoft domain in order to masquerade as a service provider for launching phishing campaigns. Domain additions are not a common occurrence and users should validate that the domain was added by a legitimate user, with a legitimate purpose.↳ also matches Add verified domain

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add user

Provider: Entra-AuditLogs

Description

A new user account was created in the directory.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Add user`	4 rules	kusto
`OperationName`	eq	`Delete user`	2 rules	kusto
`Result`	eq	`success`	3 rules	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

User Account Created Using Incorrect Naming Format source low: This query looks for accounts being created where the name does not match a defined pattern. Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts. Created accounts should be investigated to ensure they were legitimated created. The user_regex field in the query needs to be populated with the expected pattern for the environment before deployment. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies
User account created without expected attributes defined source low: This query looks for accounts being created that do not have attributes populated that are commonly populated in the tenant. Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts. Created accounts should be investigated to ensure they were legitimated created. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies
Account created from non-approved sources source medium: This query looks for an account being created from a domain that is not regularly seen in a tenant. Attackers may attempt to add accounts from these sources as a means of establishing persistant access to an environment. Created accounts should be investigated to confirm expected creation. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts

Show 2 more (5 total)

Account created or deleted by non-approved user source medium: Identifies accounts that were created or deleted by a defined list of non-approved user principal names. Add to this list before running the query for accurate results. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts↳ also matches Delete user
Account Created and Deleted in Short Timeframe source high: Search for user principal name (UPN) events. Look for accounts created and then deleted in under 24 hours. Attackers may create an account for their use, and then remove the account when no longer needed. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-account↳ also matches Delete user

YARA-L #

Entra ID Recently Created User Assigned an Entra ID Role source: Detect users who are newly created and then immediately assigned administrator level roles↳ also matches Add member to role

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Add verified domain

Provider: Entra-AuditLogs

Description

A verified custom domain was added to the tenant.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

New onmicrosoft domain added to tenant source medium: This detection looks for new onmicrosoft domains being added to a tenant. An attacker who compromises a tenant may register a new onmicrosoft domain in order to masquerade as a service provider for launching phishing campaigns. Domain additions are not a common occurrence and users should validate that the domain was added by a legitimate user, with a legitimate purpose.↳ also matches Add unverified domain

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Admin deleted security info

Provider: Entra-AuditLogs

Description

An admin removed a user's security info.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	3 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info
Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Admin registered security info

Provider: Entra-AuditLogs

Description

An admin registered security info on behalf of a user (e.g. Temporary Access Pass).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	3 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto
`azure_ad::target_user_upn`	eq	`admin_users`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Addition of a Temporary Access Pass to a Privileged Account source high: Detects when a Temporary Access Pass (TAP) is created for a Privileged Account. A Temporary Access Pass is a time-limited passcode issued by an admin that satisfies strong authentication requirements and can be used to onboard other authentication methods, including Passwordless ones such as Microsoft Authenticator or even Windows Hello. A threat actor could use a TAP to register a new authentication method to maintain persistance to an account. Review any TAP creations to ensure they were used legitimately. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts
Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info

Show 1 more (4 total)

Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin deleted security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Admin updated security info

Provider: Entra-AuditLogs

Description

An admin modified a user's security info.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	3 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin registered security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin registered security info, User changed default security info, User deleted security info, User registered security info, User reviewed security info
Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin deleted security info, Admin registered security info, User changed default security info, User deleted security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Assigns the caller to user access admin

Provider: Entra-AuditLogs

Description

A Global Administrator elevated access to User Access Administrator over Azure resources.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Subscription Permission Elevation Via AuditLogs source high: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Authentication Methods Policy Update

Provider: Entra-AuditLogs

Description

The tenant authentication-methods policy was changed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Sigma #

Certificate-Based Authentication Enabled source medium: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Bulk invite users - started (bulk)

Provider: Entra-AuditLogs

Description

A bulk guest-invite operation was started.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

External guest invitation followed by Microsoft Entra ID PowerShell signin source medium: By default guests have capability to invite more external guest users, guests also can do suspicious Microsoft Entra ID enumeration. This detection look at guest users, who have been invited or have invited recently, who also are logging via various PowerShell CLI. Ref : 'https://danielchronlund.com/2021/11/18/scary-azure-ad-tenant-enumeration-using-regular-b2b-guest-accounts/↳ also matches Invite external user, Invite external user with reset invitation status

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Change user password

Provider: Entra-AuditLogs

Description

A user changed their own password.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Consent to application

Provider: Entra-AuditLogs

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Consent to application`	5 rules	kusto
`OperationName`	eq	`Add OAuth2PermissionGrant`	3 rules	kusto
`OperationName`	eq	`Add delegated permission grant`	3 rules	kusto
`OperationName`	eq	`Add service principal`	3 rules	kusto
`displayName`	eq	`ConsentAction.Permissions`	5 rules	kusto
`displayName`	eq	`AppAddress`	3 rules	kusto
`displayName`	is_not_null		3 rules	kusto
`Category`	eq	`ApplicationManagement`	4 rules	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	4 rules	kusto, sigma
`type`	eq	`ServicePrincipal`	4 rules	kusto
`GrantConsentType`	ne	`AllPrincipals`	3 rules	kusto
`azure_ad::modified_properties_new`	contains	`addresstype`	3 rules	kusto
`azure_ad::modified_properties_new`	gt	`0`	3 rules	kusto
`key`	eq	`User-Agent`	3 rules	kusto
`ConsentFull`	contains	`files.read`	2 rules	kusto

Delete application

Provider: Entra-AuditLogs

Description

An application registration was deleted.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Application Deletion source: Delete Entra ID application. This is a soft delete, can still be recovered.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Delete conditional access policy

Provider: Entra-AuditLogs

Description

A Conditional Access policy was deleted.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Conditional Access - A Conditional Access policy was deleted source low: A Conditional Access policy was deleted from Entra ID.
Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add member to group, Add named location, Remove member from group, Update conditional access policy, Update named location

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Delete device

Provider: Entra-AuditLogs

Description

A device object was deleted.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Delete group

Provider: Entra-AuditLogs

Description

A group was deleted.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Successful Group Deletion source: Detects when a group is deleted.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Delete user

Provider: Entra-AuditLogs

Description

A user account was deleted.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Delete user`	3 rules	kusto
`OperationName`	eq	`Add user`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`ResultType`	eq	`0`	1 rule	kusto, sigma

Detection Rules #

View all rules referencing this event →

Kusto #

Suspicious Login from deleted guest account source medium: This query will detect logins from guest account which was recently deleted. For any successful logins from deleted identities should be investigated further if any existing user accounts have been altered or linked to such identity prior deletion
Account created or deleted by non-approved user source medium: Identifies accounts that were created or deleted by a defined list of non-approved user principal names. Add to this list before running the query for accurate results. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts↳ also matches Add user
Account Created and Deleted in Short Timeframe source high: Search for user principal name (UPN) events. Look for accounts created and then deleted in under 24 hours. Attackers may create an account for their use, and then remove the account when no longer needed. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-account↳ also matches Add user

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Disable account

Provider: Entra-AuditLogs

Description

A user account was disabled.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Disable Strong Authentication

Provider: Entra-AuditLogs

Description

Strong authentication (MFA) was disabled for a user.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.additional_details.key`	eq	`AuthenticationMethod`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID MFA Disabled for User source medium: Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account.↳ also matches User deleted security info

Kusto #

Multi-Factor Authentication Disabled for a User source medium: Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Enable account

Provider: Entra-AuditLogs

Description

A user account was enabled.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Hard Delete application

Provider: Entra-AuditLogs

Description

An application registration was permanently deleted (purged from the deleted-items store, not recoverable).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Application Hard Deletion source: Deletion of Entra ID application with no recovery of the application.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Invite external user

Provider: Entra-AuditLogs

Description

A guest (B2B) user was invited to the tenant.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Invite external user`	4 rules	kusto, sigma
`Result`	eq	`success`	3 rules	kusto
`Category`	eq	`UserManagement`	2 rules	kusto, sigma
`Category`	eq	`RoleManagement`	1 rule	kusto, sigma
`AADOperationType`	in	`Assign`	1 rule	kusto
`AADOperationType`	in	`AssignEligibleRole`	1 rule	kusto
`Initiator`	ne	`MS-PIM`	1 rule	kusto
`Initiator`	ne	`MS-PIM-Fairfax`	1 rule	kusto
`RoleName`	contains	`admin`	1 rule	kusto
`azure_ad::activity_display_name`	contains	`add eligible member to role`	1 rule	kusto
`azure_ad::activity_display_name`	contains	`add member to role`	1 rule	kusto
`displayName_`	eq	`Role.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Sigma #

Guest Users Invited To Tenant By Non Approved Inviters source medium: Detects guest users being invited to tenant by non-approved inviters

Elastic #

Entra ID External Guest User Invited source low: Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability.

Kusto #

Guest Users Invited to Tenant by New Inviters source medium: Detects when a Guest User is added by a user account that has not been seen adding a guest in the previous 14 days. Monitoring guest accounts and the access they are provided is important to detect potential account abuse. Accounts added should be investigated to ensure the activity was legitimate. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
Power Apps - Bulk sharing of Power Apps to newly created guest users source medium: Identifies unusual bulk sharing, based on a predefined threshold in the query, of Power Apps to newly created Microsoft Entra guest users.
New External User Granted Admin Role source medium: This query will detect instances where a newly invited external user is granted an administrative role. By default this query will alert on any granted administrative role, however this can be modified using the roles variable if false positives occur in your environment. The maximum delta between invite and escalation to admin is 60 minues, this can be configured using the deltaBetweenInviteEscalation variable.↳ also matches Redeem external user invite

Show 1 more (4 total)

External guest invitation followed by Microsoft Entra ID PowerShell signin source medium: By default guests have capability to invite more external guest users, guests also can do suspicious Microsoft Entra ID enumeration. This detection look at guest users, who have been invited or have invited recently, who also are logging via various PowerShell CLI. Ref : 'https://danielchronlund.com/2021/11/18/scary-azure-ad-tenant-enumeration-using-regular-b2b-guest-accounts/↳ also matches Bulk invite users - started (bulk), Invite external user with reset invitation status

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Invite external user with reset invitation status

Provider: Entra-AuditLogs

Description

A guest user invitation was re-sent/reset.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

External guest invitation followed by Microsoft Entra ID PowerShell signin source medium: By default guests have capability to invite more external guest users, guests also can do suspicious Microsoft Entra ID enumeration. This detection look at guest users, who have been invited or have invited recently, who also are logging via various PowerShell CLI. Ref : 'https://danielchronlund.com/2021/11/18/scary-azure-ad-tenant-enumeration-using-regular-b2b-guest-accounts/↳ also matches Bulk invite users - started (bulk), Invite external user

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Read BitLocker key

Provider: Entra-AuditLogs

Description

A BitLocker recovery key was read from the directory.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Sigma #

Bitlocker Key Retrieval source medium: Monitor and alert for Bitlocker key retrieval.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Redeem external user invite

Provider: Entra-AuditLogs

Description

A guest user redeemed their B2B invitation.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`AADOperationType`	in	`Assign`	1 rule	kusto
`AADOperationType`	in	`AssignEligibleRole`	1 rule	kusto
`Category`	eq	`RoleManagement`	1 rule	kusto, sigma
`Initiator`	ne	`MS-PIM`	1 rule	kusto
`Initiator`	ne	`MS-PIM-Fairfax`	1 rule	kusto
`OperationName`	eq	`Invite external user`	1 rule	kusto, sigma
`RoleName`	contains	`admin`	1 rule	kusto
`azure_ad::activity_display_name`	contains	`add eligible member to role`	1 rule	kusto
`azure_ad::activity_display_name`	contains	`add member to role`	1 rule	kusto
`displayName_`	eq	`Role.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

New External User Granted Admin Role source medium: This query will detect instances where a newly invited external user is granted an administrative role. By default this query will alert on any granted administrative role, however this can be modified using the roles variable if false positives occur in your environment. The maximum delta between invite and escalation to admin is 60 minues, this can be configured using the deltaBetweenInviteEscalation variable.↳ also matches Invite external user

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Register device

Provider: Entra-AuditLogs

Description

A device was registered or joined to Entra ID.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType`	eq	`Register device`	2 rules	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Register Device with Unusual User Agent (Azure AD Join) source medium: Detects successful Microsoft Entra ID audit events for Register device where additional details indicate an Azure AD join and the recorded user agent is not one of the common native registration clients (Dsreg, DeviceRegistrationClient, or Dalvik-based Android enrollment). Legitimate Windows and standard mobile enrollment flows often present predictable user-agent strings; unexpected clients may reflect scripted registration, third-party tooling, or adversary-driven device registration used for persistence or token abuse. Baseline approved provisioning tools and MDM integrations before tuning.
Entra ID Protection User Alert and Device Registration source high: Identifies sequence of events where a Microsoft Entra ID protection alert is followed by an attempt to register a new device by the same user principal. This behavior may indicate an adversary using a compromised account to register a device, potentially leading to unauthorized access to resources or persistence in the environment.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Remove member from group

Provider: Entra-AuditLogs

Description

A principal was removed from a group.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add member to group, Add named location, Delete conditional access policy, Update conditional access policy, Update named location

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Remove member from role

Provider: Entra-AuditLogs

Description

A principal was removed from a directory role.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Remove service principal

Provider: Entra-AuditLogs

Description

A service principal was removed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	contains	`certificates and secrets management`	1 rule	kusto
`OperationName`	contains	`update application`	1 rule	kusto
`azure_ad::activity_display_name`	eq	`Add service principal`	1 rule	elastic, kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Suspicious Service Principal creation activity source low: This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes)↳ also matches Add app role assignment to service principal, Add service principal

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Remove service principal credentials

Provider: Entra-AuditLogs

Description

Credentials were removed from a service principal.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Reset user password

Provider: Entra-AuditLogs

Description

An administrator reset a user's password.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Restore application

Provider: Entra-AuditLogs

Description

A soft-deleted application registration was restored.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

YARA-L #

Entra ID Application Restore source: Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Restore user

Provider: Entra-AuditLogs

Description

A soft-deleted user account was restored.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Risky user

Provider: Entra-AuditLogs

Description

A user was flagged as risky by Identity Protection.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Protection - Risk Detection - User Risk source high: Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.↳ also matches User Risk Detection

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set Company Information

Provider: Entra-AuditLogs

Description

Tenant company branding/information was changed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Sigma #

New Root Certificate Authority Added source medium: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set device registration policies

Provider: Entra-AuditLogs

Description

Device registration policies were changed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`Policy`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Changes to Device Registration Policy source high: Monitor and alert for changes to the device registration policy.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set DirSyncEnabled flag

Provider: Entra-AuditLogs

Description

Directory synchronization was enabled or disabled for the tenant.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set domain authentication

Provider: Entra-AuditLogs

Description

A domain's authentication type was changed (managed vs federated).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Set domain authentication`	2 rules	kusto
`OperationName`	eq	`Set federation settings on domain`	2 rules	kusto
`displayName`	eq	`LiveType`	2 rules	kusto
`key`	eq	`User-Agent`	2 rules	kusto
`azure.auditlogs.properties.category`	eq	`DirectoryManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Domain Federation Configuration Change source high: Detects when domain federation settings are configured or modified in an Entra ID tenant via the Microsoft Graph API. Adversaries with Global Administrator or Domain Administrator privileges may add a custom domain, verify ownership, and configure it to federate authentication with an attacker-controlled identity provider. Once federated, the adversary can forge SAML or WS-Federation tokens to authenticate as any user under that domain, bypassing MFA and conditional access policies. This technique, commonly known as Golden SAML, was used by UNC2452 (APT29) during the SolarWinds campaign for persistent, stealthy access to victim tenants.↳ also matches Set federation settings on domain

Kusto #

Modified domain federation trust settings source high: This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added to the domain. Modification to domain federation settings should be rare. Confirm the added or modified target domain/URL is legitimate administrator behavior. To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see: https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365. For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Set federation settings on domain
NRT Modified domain federation trust settings source high: This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added to the domain. Modification to domain federation settings should be rare. Confirm the added or modified target domain/URL is legitimate administrator behavior. To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see: https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365. For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Set federation settings on domain

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set federation settings on domain

Provider: Entra-AuditLogs

Description

Federation settings on a domain were changed (federated-trust backdoor technique).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Set domain authentication`	2 rules	kusto
`OperationName`	eq	`Set federation settings on domain`	2 rules	kusto
`displayName`	eq	`LiveType`	2 rules	kusto
`key`	eq	`User-Agent`	2 rules	kusto
`azure.auditlogs.properties.category`	eq	`DirectoryManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Domain Federation Settings Modified source medium: Identifies when an user or application modified the federation settings on the domain.

Elastic #

Entra ID Domain Federation Configuration Change source high: Detects when domain federation settings are configured or modified in an Entra ID tenant via the Microsoft Graph API. Adversaries with Global Administrator or Domain Administrator privileges may add a custom domain, verify ownership, and configure it to federate authentication with an attacker-controlled identity provider. Once federated, the adversary can forge SAML or WS-Federation tokens to authenticate as any user under that domain, bypassing MFA and conditional access policies. This technique, commonly known as Golden SAML, was used by UNC2452 (APT29) during the SolarWinds campaign for persistent, stealthy access to victim tenants.↳ also matches Set domain authentication

Kusto #

Modified domain federation trust settings source high: This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added to the domain. Modification to domain federation settings should be rare. Confirm the added or modified target domain/URL is legitimate administrator behavior. To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see: https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365. For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Set domain authentication
NRT Modified domain federation trust settings source high: This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added to the domain. Modification to domain federation settings should be rare. Confirm the added or modified target domain/URL is legitimate administrator behavior. To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see: https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365. For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.↳ also matches Set domain authentication

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Set force change user password

Provider: Entra-AuditLogs

Description

A user was flagged to change password at next sign-in.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Suspicious activity reported

Provider: Entra-AuditLogs

Description

Suspicious activity was reported for a user (e.g. MFA fraud report).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.additional_details.key`	eq	`AuthenticationMethod`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID User Reported Suspicious Activity source medium: Identifies suspicious activity reported by users in Microsoft Entra ID where users have reported suspicious activity related to their accounts, which may indicate potential compromise or unauthorized access attempts. Reported suspicious activity typically occurs during the authentication process and may involve various authentication methods, such as password resets, account recovery, or multi-factor authentication challenges. Adversaries may attempt to exploit user accounts by leveraging social engineering techniques or other methods to gain unauthorized access to sensitive information or resources.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update application

Provider: Entra-AuditLogs

Description

An application registration was modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`AddedUrls`	gt	`0`	2 rules	kusto
`Category`	eq	`ApplicationManagement`	2 rules	kusto
`Details`	is_not_null		2 rules	elastic, kusto, splunk
`Key`	is_not_null		2 rules	kusto
`OperationName`	eq	`Update Application`	2 rules	kusto
`Result`	eq	`success`	2 rules	kusto
`displayName`	eq	`AppAddress`	2 rules	kusto
`Domain`	is_not_null		1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Federated Identity Credential Issuer Modified source high: Detects when the issuer URL of a federated identity credential is changed on an Entra ID application. Adversaries may modify the issuer to point to an attacker-controlled identity provider, enabling them to authenticate as the application's service principal and gain persistent access to Azure resources. This technique allows bypassing traditional authentication controls by federating trust with a malicious external identity provider.

Kusto #

Application Redirect URL Update source medium: Detects the redirect URL of an app being changed. Applications associated with URLs not controlled by the organization can pose a security risk. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-configuration-changes
URL Added to Application from Unknown Domain source high: Detects a URL being added to an application where the domain is not one that is associated with the tenant. The query uses domains seen in sign in logs to determine if the domain is associated with the tenant. Applications associated with URLs not controlled by the organization can pose a security risk. Ref: https://learn.microsoft.com/en-gb/entra/architecture/security-operations-applications#application-configuration-changes

YARA-L #

Entra ID Excessive Permission Changes to Application source: Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update Application - Certificates and secrets management

Provider: Entra-AuditLogs

Description

Credentials (certificate or client secret) were added or changed on an application.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Application Credential Modified source medium: Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update conditional access policy

Provider: Entra-AuditLogs

Description

A Conditional Access policy was modified (tampering can weaken enforcement).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Update conditional access policy`	6 rules	kusto
`stateOld`	eq	`enabled`	2 rules	kusto
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Conditional Access Policy (CAP) Modified source medium: Identifies a modification to a conditional access policy (CAP) in Microsoft Entra ID. Adversaries may modify existing CAPs to loosen access controls and maintain persistence in the environment with a compromised identity or entity.

Kusto #

Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) source low: A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.
Conditional Access - A Conditional Access app exclusion has changed source low: A Conditional Access app exclusion has changed in Entra ID.
Conditional Access - A Conditional Access policy was disabled source low: A Conditional Access policy was disabled in Entra ID.

Show 4 more (7 total)

Conditional Access - A Conditional Access policy was put into report-only mode source low: A Conditional Access policy was put into report-only mode in Entra ID.
Conditional Access - A Conditional Access policy was updated source informational: A Conditional Access policy was updated in Entra ID.
Conditional Access - A Conditional Access user/group/role exclusion has changed source high: A Conditional Access user/group/role exclusion has changed in Azure AD.
Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add member to group, Add named location, Delete conditional access policy, Remove member from group, Update named location

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update device

Provider: Entra-AuditLogs

Description

A device object was modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Included Updated Properties`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Suspicious Entra ID Joined Device Update source medium: This query looks for suspicious updates to an Microsoft Entra ID joined device where the device name is changed and the device falls out of compliance. This could occur when a threat actor updates the details of an Autopilot provisioned device using a stolen device ticket, in order to access certificates and keys. Ref: https://dirkjanm.io/assets/raw/Insomnihack Breaking and fixing Azure AD device identity security.pdf

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update group

Provider: Entra-AuditLogs

Description

A group's properties were modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Kusto #

Conditional Access - Dynamic Group Exclusion Changes source high: // Detects changes to Dynamic Membership Rules for specified groups (often used in CA exclusions)

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update named location

Provider: Entra-AuditLogs

Description

A named location was modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`displayName`	eq	`Group.DisplayName`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.↳ also matches Add member to group, Add named location, Delete conditional access policy, Remove member from group, Update conditional access policy

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update role definition

Provider: Entra-AuditLogs

Description

A custom directory role definition was modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update role setting in PIM

Provider: Entra-AuditLogs

Description

PIM role settings (activation duration, approval, MFA requirement) were changed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`RoleManagement`	1 rule	kusto, sigma

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Privileged Identity Management (PIM) Role Modified source medium: Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls.

Kusto #

Changes to PIM Settings source high: PIM provides a key mechanism for assigning privileges to accounts, this query detects changes to PIM role settings. Monitor these changes to ensure they are being made legitimately and don't confer more privileges than expected or reduce the security of a PIM elevation. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update StsRefreshTokenValidFrom Timestamp

Provider: Entra-AuditLogs

Description

A user's refresh tokens were invalidated (revoke sessions); also set silently by some attacks.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update user

Provider: Entra-AuditLogs

Description

A user account attribute was modified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OperationName`	eq	`Update user`	6 rules	kusto, sigma
`Result`	eq	`success`	3 rules	kusto
`Category`	eq	`UserManagement`	2 rules	kusto, sigma
`Tactics`	contains	`exfiltration`	1 rule	kusto
`Value`	eq	`False`	1 rule	kusto
`azure_ad::logged_by_service`	eq	`Core Directory`	1 rule	kusto, sigma

Detection Rules #

View all rules referencing this event →

Sigma #

User State Changed From Guest To Member source medium: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Multi Factor Authentication Disabled For User Account source medium: Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Kusto #

Suspicious linking of existing user to external User source medium: This query will detect when an attempt is made to update an existing user and link it to an guest or external identity. These activities are unusual and such linking of external identities should be investigated. In some cases you may see internal Entra ID sync accounts (Sync_) do this which may be benign
Suspicious modification of Global Administrator user properties source medium: This query will detect if user properties of Global Administrator are updated by an existing user. Usually only user administrator or other global administrator can update such properties. Investigate if such user change is an attempt to elevate an existing low privileged identity or rogue administrator activity
Dataverse - Guest user exfiltration following Power Platform defense impairment source high: Identifies a chain of events starting with disablement of Power Platform tenant isolation and removal of an environment's access security group. These events are correlated with Dataverse exfiltration alerts associated with the impacted environment and recently created Microsoft Entra guest users. Note: Activate other Dataverse analytics rules with the MITRE tactic 'Exfiltration' before enabling this rule.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Update User Risk and MFA Registration Policy

Provider: Entra-AuditLogs

Description

The user-risk or MFA-registration policy was changed.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`Policy`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

User Risk and MFA Registration Policy Updated source high: Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User changed default security info

Provider: Entra-AuditLogs

Description

A user changed their default authentication method.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	3 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User deleted security info, User registered security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User deleted security info, User registered security info, User reviewed security info
Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User deleted security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User deleted security info

Provider: Entra-AuditLogs

Description

A user removed one of their authentication methods.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	3 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto
`azure.auditlogs.properties.additional_details.key`	eq	`AuthenticationMethod`	1 rule	elastic
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID MFA Disabled for User source medium: Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account.↳ also matches Disable Strong Authentication

Kusto #

Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User registered security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User registered security info, User reviewed security info
Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User has elevated their access to User Access Administrator for their Azure Resources

Provider: Entra-AuditLogs

Description

A Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::activity_display_name`	eq	`User has elevated their access to User Access Administrator for their Azure Resources`	2 rules	elastic, kusto

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Elevated Access to User Access Administrator source high: Identifies when a user has elevated their access to User Access Administrator for their Azure Resources. The User Access Administrator role allows users to manage user access to Azure resources, including the ability to assign roles and permissions. Adversaries may target an Entra ID Global Administrator or other privileged role to elevate their access to User Access Administrator, which can lead to further privilege escalation and unauthorized access to sensitive resources. This is a New Terms rule that only signals if the user principal name has not been seen doing this activity in the last 14 days.

Kusto #

Azure RBAC (Elevate Access) source high: Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. Learn more

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User registered security info

Provider: Entra-AuditLogs

Description

A user registered an authentication method (MFA/SSPR security info).

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Category`	eq	`UserManagement`	5 rules	kusto, sigma
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`azure_ad::logged_by_service`	eq	`Authentication Methods`	2 rules	kusto, sigma
`azure_ad::target_user_upn`	eq	`VIPUsers`	2 rules	kusto
`type`	eq	`User`	2 rules	kusto

Detection Rules #

View all rules referencing this event →

Sigma #

Change to Authentication Method source medium: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Kusto #

Authentication Method Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1
Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User reviewed security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User reviewed security info

Show 1 more (4 total)

Suspicious Sign In Followed by MFA Modification source medium: This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User deleted security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User reviewed security info

Provider: Entra-AuditLogs

Description

A user reviewed their registered security info.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::activity_display_name`	in	`Admin deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`Admin updated security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User changed default security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User deleted security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User registered security info`	2 rules	kusto
`azure_ad::activity_display_name`	in	`User reviewed security info`	2 rules	kusto
`azure_ad::target_user_upn`	eq	`VIPUsers`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto #

Authentication Methods Changed for Privileged Account source high: Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info
NRT Authentication Methods Changed for VIP Users source medium: Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.↳ also matches Admin deleted security info, Admin registered security info, Admin updated security info, User changed default security info, User deleted security info, User registered security info

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

User Risk Detection

Provider: Entra-AuditLogs

Description

Identity Protection raised a user-risk detection.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Protection - Risk Detection - Sign-in Risk source high: Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more.
Entra ID Protection - Risk Detection - User Risk source high: Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.↳ also matches Risky user

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Verify domain

Provider: Entra-AuditLogs

Description

A custom domain was verified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.category`	eq	`DirectoryManagement`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Entra ID Custom Domain Added or Verified source low: Detects when a custom domain is added or verified in an Entra ID tenant. Adding and verifying a custom domain are precursor steps to configuring domain federation, which can be abused by adversaries to route authentication through an attacker-controlled identity provider (Golden SAML). In most organizations, custom domains are added infrequently and these events should be investigated to ensure they are part of a legitimate administrative workflow.↳ also matches Add unverified domain

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

Verify email verified domain

Provider: Entra-AuditLogs

Description

An email-verified domain was verified.

Fields #

Name	Description
`OperationName`	The audit operation name (= activityDisplayName in the Graph directoryAudit resource). The per-record discriminator detection rules filter on.
`ActivityDisplayName`	Human-readable operation name; carries the same value as OperationName in the AuditLogs table.
`Category`	Audit category (RoleManagement, UserManagement, ApplicationManagement, GroupManagement, Policy, Device, KeyManagement, ...).
`LoggedByService`	The Entra service that logged the event (Core Directory, PIM, Authentication Methods, Conditional Access, Identity Protection, ...).
`Result`	Operation result: success, failure, or timeout.
`ResultReason`	Free-text description of the result or failure reason.
`InitiatedBy`	Actor that triggered the operation: user UPN, service principal app id, or a Microsoft service string.
`TargetResources`	JSON array of objects affected (users, groups, applications, service principals, policies, roles), with modifiedProperties.
`AdditionalDetails`	Key-value pairs carrying operation-specific context not in the top-level columns.
`CorrelationId`	GUID correlating related records emitted by the same request.
`TimeGenerated`	UTC timestamp when the event was recorded in Log Analytics.

References #

Microsoft Entra audit log activity reference https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Graph API directoryAudit resource type https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0
Azure Monitor AuditLogs table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)