Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: AdministrativeUnit

OperationName	Description	Sample	Rule
Add administrative unit	An administrative unit (container that scopes delegated role permissions to a subset of the directory) was created.	Y	N
Add member to administrative unit	A user, group, or device was added as a member of an administrative unit.	Y	N
Add member to restricted management administrative unit	An object was added to a restricted management administrative unit, which shields it from tenant-level admins.	N	N
Bulk add members to administrative unit - finished (bulk)	Completion of an administrator bulk operation that adds members to an administrative unit (CSV upload).	N	N
Bulk remove members to administrative unit - finished (bulk)	A bulk job that removes members from an administrative unit via an uploaded CSV completed.	N	N
Delete administrative unit	An administrative unit (scoped-admin delegation container) was deleted.	Y	Y
Hard Delete administrative unit	An administrative unit was permanently (hard) deleted and can no longer be restored.	N	N
Remove member from administrative unit	Removal of a user, group, or device from an administrative unit, taking it out of that unit's delegated admin scope.	Y	N
Remove member from restricted management administrative unit	Removal of a user, group, or device from a restricted management administrative unit, stripping the object's enhanced protection.	N	N
Restore administrative unit	A soft-deleted administrative unit was restored to an active state.	N	N
Update administrative unit	Modification of an administrative unit (container scoping delegated admin over users, groups, or devices).	Y	N

Add administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

An administrative unit was created. Administrative units are Microsoft Entra containers for users, groups, or devices that scope delegated directory-role permissions to a defined subset of the organization.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:10.3385637Z",
  "ActivityDisplayName": "Add administrative unit",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "AdministrativeUnit",
  "CorrelationId": "bac34c3a-9cfe-4dd5-87a1-7baf6e9953e9",
  "DurationMs": "0",
  "Id": "Directory_bac34c3a-9cfe-4dd5-87a1-7baf6e9953e9_NMFE2_148674795",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add administrative unit",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "a2c2d2a2-519f-4f04-b46f-4d8566ba2a53",
      "displayName": "dw-harness-aum-cf516524",
      "type": "Manager",
      "modifiedProperties": [
        {
          "displayName": "DisplayName",
          "oldValue": [],
          "newValue": [
            "dw-harness-aum-cf516524"
          ]
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"DisplayName\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Add member to administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

A user, group, or device was added as a member of an administrative unit in Microsoft Entra ID. Administrative units scope the management permissions of admin roles to a subset of directory objects, so membership changes alter delegated-administration boundaries.

Example Audit Log Entry #

{
  "AADOperationType": "Assign",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:11.8112894Z",
  "ActivityDisplayName": "Add member to administrative unit",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "AdministrativeUnit",
  "CorrelationId": "bae794d4-63ae-4d8a-8283-ef2a52c69eec",
  "DurationMs": "0",
  "Id": "Directory_bae794d4-63ae-4d8a-8283-ef2a52c69eec_GH3E7_172513570",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add member to administrative unit",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "type": "User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "modifiedProperties": [
        {
          "displayName": "AdministrativeUnit.ObjectID",
          "oldValue": null,
          "newValue": "\"a2c2d2a2-519f-4f04-b46f-4d8566ba2a53\""
        },
        {
          "displayName": "AdministrativeUnit.DisplayName",
          "oldValue": null,
          "newValue": "\"dw-harness-aum-cf516524\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    },
    {
      "id": "a2c2d2a2-519f-4f04-b46f-4d8566ba2a53",
      "displayName": null,
      "type": "AdministrativeUnit",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Add member to restricted management administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

An object (user, security group, or device) was added as a member of a restricted management administrative unit in Microsoft Entra ID. Restricted management administrative units protect their members from modification by anyone except administrators explicitly scoped to that unit, so membership changes shift which objects are shielded from tenant-level admins. Detection relevance: these units harden sensitive objects such as executive accounts and sensitive security groups, so unexpected membership changes can indicate tampering with protected objects.

References #

Bulk add members to administrative unit - finished (bulk)

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records completion of an administrator-initiated bulk operation that adds members to an administrative unit from an uploaded CSV (object IDs or UPNs) via the Microsoft Entra admin center; the 'finished (bulk)' marker denotes the batch job completing. Administrative-unit membership changes can alter the scope of scoped administrative roles.

References #

Bulk remove members to administrative unit - finished (bulk)

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records that a bulk operation to remove members from an administrative unit using an uploaded CSV finished. Administrative-unit membership defines the scope of delegated scoped-admin roles, so changes affect who scoped administrators can manage.

References #

Delete administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

An administrative unit was deleted. Administrative units scope administrator permissions to a subset of users, groups, or devices, so deleting one removes that delegation boundary, including any restricted-management protections it provided.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:13.4771173Z",
  "ActivityDisplayName": "Delete administrative unit",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "AdministrativeUnit",
  "CorrelationId": "63eda07b-6883-4942-ad5d-1ac3dfb6d078",
  "DurationMs": "0",
  "Id": "Directory_63eda07b-6883-4942-ad5d-1ac3dfb6d078_JANDY_146321029",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Delete administrative unit",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "a2c2d2a2-519f-4f04-b46f-4d8566ba2a53",
      "displayName": "dw-harness-aum-cf516524",
      "type": "Manager",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Azure Application Deleted source medium: Identifies when a application is deleted in Azure.T1489↳ also matches Delete application, Hard Delete application

References #

Hard Delete administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records the permanent (hard) deletion of an administrative unit, removing it from the tenant so it can no longer be restored; for administrative units this normally occurs automatically after the 30-day soft-delete window, since they cannot be manually hard-deleted during that window. Because administrative units scope delegated admin permissions and visibility over a set of objects, permanently deleting one destroys that scoping and its recoverability, which can be relevant to defense-evasion detection.

References #

Remove member from administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records removal of a user, group, or device from a Microsoft Entra administrative unit. Administrative-unit membership defines which objects fall under that unit's scoped, delegated administration, so removing a member takes the object out of the management scope of any administrators delegated over the unit.

Example Audit Log Entry #

{
  "AADOperationType": "Unassign",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:12.5720716Z",
  "ActivityDisplayName": "Remove member from administrative unit",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "AdministrativeUnit",
  "CorrelationId": "ea3d6903-8762-4bdb-92c9-9cbc7a1b483c",
  "DurationMs": "0",
  "Id": "Directory_ea3d6903-8762-4bdb-92c9-9cbc7a1b483c_ATINI_155001896",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Remove member from administrative unit",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "type": "User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "modifiedProperties": [
        {
          "displayName": "AdministrativeUnit.ObjectID",
          "oldValue": "\"a2c2d2a2-519f-4f04-b46f-4d8566ba2a53\"",
          "newValue": null
        },
        {
          "displayName": "AdministrativeUnit.DisplayName",
          "oldValue": "\"dw-harness-aum-cf516524\"",
          "newValue": null
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    },
    {
      "id": "a2c2d2a2-519f-4f04-b46f-4d8566ba2a53",
      "displayName": null,
      "type": "AdministrativeUnit",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Remove member from restricted management administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records removal of a user, group, or device from a restricted management administrative unit. These units shield their members so that only administrators explicitly assigned at that scope can modify them, so removing a member strips that enhanced protection from the object.

References #

Restore administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records that a soft-deleted administrative unit was restored to an active state. Administrative units remain recoverable for 30 days via the directory deletedItems Microsoft Graph API, and restoration reinstates the unit with all properties maintained, so an unexpected restore can re-establish delegated administrative scoping that had been removed.

References #

Update administrative unit

Source: Microsoft Entra ID audit log
Audit Category: AdministrativeUnit

Description

Records modification of an administrative unit in Microsoft Entra ID, a container of users, groups, or devices used to scope delegated and restricted administration. Changes can alter the scope over which delegated admin roles apply, which is relevant to privilege escalation.

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:20:32.7053537Z",
  "ActivityDisplayName": "Update administrative unit",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "AdministrativeUnit",
  "CorrelationId": "d3a2f1c2-0e33-4ec3-8d28-4342927e6eaf",
  "DurationMs": "0",
  "Id": "Directory_d3a2f1c2-0e33-4ec3-8d28-4342927e6eaf_Q87VI_7106090",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Update administrative unit",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "91773d42-0eee-4b65-b015-58e1d3ce13e8",
      "displayName": "dw-harness-au-cf516524",
      "type": "Manager",
      "modifiedProperties": [
        {
          "displayName": "Description",
          "oldValue": [],
          "newValue": [
            "harness"
          ]
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"Description\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.

Audit Logs: AdministrativeUnit

Add administrative unit

Description

Example Audit Log Entry #

References #

Add member to administrative unit

Description

Example Audit Log Entry #

References #

Add member to restricted management administrative unit

Description

References #

Bulk add members to administrative unit - finished (bulk)

Description

References #

Bulk remove members to administrative unit - finished (bulk)

Description

References #

Delete administrative unit

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Sigma #

References #

Hard Delete administrative unit

Description

References #

Remove member from administrative unit

Description

Example Audit Log Entry #

References #

Remove member from restricted management administrative unit

Description

References #

Restore administrative unit

Description

References #

Update administrative unit

Description

Example Audit Log Entry #

References #