Audit Logs

Category	Operations	Samples	Rules
GroupManagement	130	28	6
Authorization	125	4	1
UserManagement	98	24	22
DirectoryManagement	91	3	6
ApplicationManagement	69	24	18
EntitlementManagement	57	4	0
Policy	53	10	8
ResourceManagement	46	1	1
Authentication	32	3	0
RoleManagement	28	15	12
PolicyManagement	21	2	0
Device	18	5	8
WorkflowManagement	17	0	0
ProvisioningManagement	15	0	0
Other	12	0	0
AdministrativeUnit	11	5	1
CrossTenantAccessSettings	9	3	0
PublicKeyInfrastructure	6	0	0
CertificateAuthorityEntity	5	0	0
MicrosoftSupportAccessManagement	5	0	0
MultiTenantOrgTenant	5	0	0
ObjectManagement	5	0	0
TaskManagement	5	0	0
Agreement	4	0	0
CompanyBranding	4	0	0
CompanyBrandingLocale	4	0	0
DeviceTemplate	4	0	0
KerberosDomain	4	0	0
AzureRBACRoleManagementElevateAccess	3	1	2
CertificateBasedAuthConfiguration	3	0	0
Contact	3	0	0
CrossTenantIdentitySyncSettings	3	0	0
DelegatedAdminServiceProviderConstraints	3	1	0
DeviceConfiguration	3	0	2
KeyManagement	3	0	1
Label	3	0	0
MultiTenantOrg	3	0	0
OrganizationalUnitContainer	3	0	0
PendingExternalUserProfile	3	0	0
PermissionGrantPolicy	3	2	0
CertBasedConfiguration	2	0	0
DeviceManagement	2	0	0
IdentityProtection	2	0	0
MultiTenantOrgIdentitySyncPolicyUpdate	2	0	0
MultiTenantOrgPartnerConfigurationTemplate	2	0	0

Scope groupings

These repository-authored rows represent AuditLogs-wide attribution scopes rather than concrete OperationName values. They are not distinct emitted operations; the Rule column shows whether a detection is currently attached.

Scope	Description	Representative record	Rule
any	Any Microsoft Entra ID directory audit operation recorded in the AuditLogs table (no specific OperationName filter).	N	Y

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.