Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: CertBasedConfiguration
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Add Cert | A certificate-based authentication configuration (CBA settings, e.g. trusted CAs) was created in the directory. | N | N |
| Hard delete Certification | Permanent deletion of the trusted-CA collection used for Entra certificate-based authentication. | N | N |
Add CertBasedAuthConfiguration
#Description
A certificate-based authentication configuration was created in the directory, defining settings used to validate user X.509 certificates for sign-in, including the trusted certificate authorities. Adding or altering trusted CAs is security-sensitive because it governs which certificates are accepted for authentication, and a rogue CA could enable certificate-based authentication abuse.
References #
Hard delete CertificationBasedAuthConfiguration
#Description
Records the permanent (hard) deletion of the certificateBasedAuthConfiguration object, the collection of trusted certificate authorities Microsoft Entra uses to validate the certificate chain for certificate-based authentication. This configuration can only be changed by deleting and recreating it, so the event can be routine reconfiguration or indicate tampering with the CBA trust anchor.
References #
Computed Fields in AuditLogs #
Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.
Initiating*values come fromInitiatedBy:InitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, orInitiatedBy.user.id; application actors useInitiatedBy.app.displayNameorInitiatedBy.app.appId.- Change details come from
TargetResources[].modifiedProperties. ExpandTargetResourcesbefore usingdisplayName,oldValue, ornewValue.
Sources: the AuditLogs table reference and Graph directoryAudit resource.