detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CertificateBasedAuthConfiguration

OperationNameDescriptionSampleRule
Add CertificateBasedAuthConfigurationThe tenant's certificate-based authentication configuration (trusted CA store) object was created.NN
Delete CertificateBasedAuthConfigurationThe tenant's certificate-based authentication configuration (trusted CA store) was deleted.NN
Update CertificateBasedAuthConfigurationChange to the tenant certificate-based auth configuration (trusted CA collection).NN

Add CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

The tenant's certificate-based authentication configuration object was created, establishing the trusted certificate authority (CA) store that Microsoft Entra uses to validate user certificates during certificate-based authentication. Trusted-CA changes are security-sensitive: an attacker-controlled CA in the store could enable certificate-based authentication bypass or user impersonation.

References #

Delete CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

The tenant's certificate-based authentication configuration object, which holds the collection of trusted certificate authorities, was deleted. Removing it tears down the trust store that governs certificate-based sign-in for the tenant.

References #

Update CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

Records a change to the tenant certificate-based authentication configuration, which holds the collection of trusted certificate authorities used for Microsoft Entra CBA. Because this configuration defines which CAs are trusted for certificate sign-in, modifications are relevant to detecting authentication-bypass or persistence attempts.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.