Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Agreement

OperationName	Description	Sample	Rule
Add agreement	A terms of use agreement was created (content users must accept, typically enforced via Conditional Access).	N	N
Delete agreement	A terms of use agreement (Conditional Access acceptance policy) was deleted.	N	N
Hard delete agreement	Permanent deletion of a Microsoft Entra terms-of-use agreement object.	N	N
Update agreement	Modification of a terms of use agreement (the document users must accept before accessing resources).	N	N

Add agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

A terms of use (ToU) agreement was created. Terms of use agreements present content that users must accept, typically enforced at sign-in through a Conditional Access policy.

References #

Delete agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

A terms of use agreement was deleted. In the directory the agreement object is a Conditional Access terms of use policy presented to users before access is granted, so deleting it removes that acceptance requirement and its recorded consents.

References #

Hard delete agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

Records the permanent (hard) deletion of a terms-of-use agreement object from the Microsoft Entra tenant. Removing a terms-of-use agreement strips the terms users are required to accept and can weaken Conditional Access gating that references it.

References #

Update agreement

Source: Microsoft Entra ID audit log
Audit Category: Agreement

Description

Records modification of a terms of use agreement in Microsoft Entra, the document (typically a PDF) that users must accept, usually enforced through Conditional Access, before they are granted access to resources.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.