Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Agreement

OperationName	Description	Sample	Rule
Add agreement	A terms of use agreement was created (content users must accept, typically enforced via Conditional Access).	N	N
Delete agreement	A terms of use agreement (Conditional Access acceptance policy) was deleted.	N	N
Hard delete agreement	Permanent deletion of a Microsoft Entra terms-of-use agreement object.	N	N
Update agreement	Modification of a terms of use agreement (the document users must accept before accessing resources).	N	N

Add agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

A terms of use (ToU) agreement was created. Terms of use agreements present content that users must accept, typically enforced at sign-in through a Conditional Access policy.

References #

Delete agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

A terms of use agreement was deleted. In the directory the agreement object is a Conditional Access terms of use policy presented to users before access is granted, so deleting it removes that acceptance requirement and its recorded consents.

References #

Hard delete agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

Records the permanent (hard) deletion of a terms-of-use agreement object from the Microsoft Entra tenant. Removing a terms-of-use agreement strips the terms users are required to accept and can weaken Conditional Access gating that references it.

References #

Update agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

Records modification of a terms of use agreement in Microsoft Entra, the document (typically a PDF) that users must accept, usually enforced through Conditional Access, before they are granted access to resources.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.