Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: CertBasedConfiguration
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Add Cert | A certificate-based authentication configuration (CBA settings, e.g. trusted CAs) was created in the directory. | N | N |
| Hard delete Certification | Permanent deletion of the trusted-CA collection used for Entra certificate-based authentication. | N | N |
Add CertBasedAuthConfiguration
#Description
A certificate-based authentication configuration was created in the directory, defining settings used to validate user X.509 certificates for sign-in, including the trusted certificate authorities. Adding or altering trusted CAs is security-sensitive because it governs which certificates are accepted for authentication, and a rogue CA could enable certificate-based authentication abuse.
References #
Hard delete CertificationBasedAuthConfiguration
#Description
Records the permanent (hard) deletion of the certificateBasedAuthConfiguration object, the collection of trusted certificate authorities Microsoft Entra uses to validate the certificate chain for certificate-based authentication. This configuration can only be changed by deleting and recreating it, so the event can be routine reconfiguration or indicate tampering with the CBA trust anchor.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.