detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CertificateAuthorityEntity

OperationNameDescriptionSampleRule
Create CertificateAuthorityEntityA certificate authority was added to the Entra CBA trust store, expanding which certificates can authenticate users.NN
Delete CertificateAuthorityEntityA trusted certificate authority was removed from the tenant's certificate-based authentication trust store.NN
Hard Delete CertificateAuthorityEntityPermanent deletion of a certificate authority from the Entra certificate-based auth trust store.NN
Restore CertificateAuthorityEntityA certificate authority entity in the tenant trust store was restored.NN
Update CertificateAuthorityEntityChange to a certificate authority entity in the Entra CBA trust store.NN

Create CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

A certificate authority was added to the Microsoft Entra trust store for certificate-based authentication, including its public certificate and certificate revocation list location. Trusted CAs validate the user certificates accepted at sign-in, so adding one expands which certificates can authenticate and is a sensitive trust change to monitor.

References #

Delete CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

A trusted certificate authority was removed from the tenant's certificate-based authentication trust store. The set of trusted CAs governs which issuing authorities Microsoft Entra accepts for certificate-based sign-in, so changes are relevant when auditing tampering with authentication trust anchors.

References #

Hard Delete CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records the permanent (hard) deletion of a certificate authority entry from the tenant's certificate-based authentication (CBA) trust store. The trusted CA set determines which client certificates Microsoft Entra accepts, so removing an entry modifies the CBA trust anchor and is a security-relevant change.

References #

Restore CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records that a certificate authority entity in the tenant's certificate-based authentication trust store was restored. Restoring a trusted certificate authority re-establishes which issuing CA certificates can be used to authenticate users, making unexpected restores relevant to certificate-based authentication integrity.

References #

Update CertificateAuthorityEntity

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateAuthorityEntity

Description

Records a change to a certificate authority entity in the Microsoft Entra trust store used for certificate-based authentication (CBA). The CBA trust store holds the trusted CAs that validate user sign-in certificates; modifying a trusted CA is security-relevant because an attacker-controlled CA could enable certificate-based authentication bypass or persistence.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.