detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CertificateBasedAuthConfiguration

OperationNameDescriptionSampleRule
Add CertificateBasedAuthConfigurationThe tenant's certificate-based authentication configuration (trusted CA store) object was created.NN
Delete CertificateBasedAuthConfigurationThe tenant's certificate-based authentication configuration (trusted CA store) was deleted.NN
Update CertificateBasedAuthConfigurationChange to the tenant certificate-based auth configuration (trusted CA collection).NN

Add CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

The tenant's certificate-based authentication configuration object was created, establishing the trusted certificate authority (CA) store that Microsoft Entra uses to validate user certificates during certificate-based authentication. Trusted-CA changes are security-sensitive: an attacker-controlled CA in the store could enable certificate-based authentication bypass or user impersonation.

References #

Delete CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

The tenant's certificate-based authentication configuration object, which holds the collection of trusted certificate authorities, was deleted. Removing it tears down the trust store that governs certificate-based sign-in for the tenant.

References #

Update CertificateBasedAuthConfiguration

#
Source
Microsoft Entra ID audit log
Audit Category
CertificateBasedAuthConfiguration

Description

Records a change to the tenant certificate-based authentication configuration, which holds the collection of trusted certificate authorities used for Microsoft Entra CBA. Because this configuration defines which CAs are trusted for certificate sign-in, modifications are relevant to detecting authentication-bypass or persistence attempts.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.