detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CertificateAuthorityEntity

OperationNameDescriptionSampleRule
Create CertificateAuthorityEntityA certificate authority was added to the Entra CBA trust store, expanding which certificates can authenticate users.NN
Delete CertificateAuthorityEntityA trusted certificate authority was removed from the tenant's certificate-based authentication trust store.NN
Hard Delete CertificateAuthorityEntityPermanent deletion of a certificate authority from the Entra certificate-based auth trust store.NN
Restore CertificateAuthorityEntityA certificate authority entity in the tenant trust store was restored.NN
Update CertificateAuthorityEntityChange to a certificate authority entity in the Entra CBA trust store.NN

Create CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

A certificate authority was added to the Microsoft Entra trust store for certificate-based authentication, including its public certificate and certificate revocation list location. Trusted CAs validate the user certificates accepted at sign-in, so adding one expands which certificates can authenticate and is a sensitive trust change to monitor.

References #

Delete CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

A trusted certificate authority was removed from the tenant's certificate-based authentication trust store. The set of trusted CAs governs which issuing authorities Microsoft Entra accepts for certificate-based sign-in, so changes are relevant when auditing tampering with authentication trust anchors.

References #

Hard Delete CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records the permanent (hard) deletion of a certificate authority entry from the tenant's certificate-based authentication (CBA) trust store. The trusted CA set determines which client certificates Microsoft Entra accepts, so removing an entry modifies the CBA trust anchor and is a security-relevant change.

References #

Restore CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records that a certificate authority entity in the tenant's certificate-based authentication trust store was restored. Restoring a trusted certificate authority re-establishes which issuing CA certificates can be used to authenticate users, making unexpected restores relevant to certificate-based authentication integrity.

References #

Update CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records a change to a certificate authority entity in the Microsoft Entra trust store used for certificate-based authentication (CBA). The CBA trust store holds the trusted CAs that validate user sign-in certificates; modifying a trusted CA is security-relevant because an attacker-controlled CA could enable certificate-based authentication bypass or persistence.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.