Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CompanyBranding

OperationName	Description	Sample	Rule
Create Branding Theme	A company-branding theme was created to customize the sign-in experience (background, logo, layout, header, footer).	N	N
Delete Branding Theme	A company branding theme was deleted.	N	N
Hard Delete Branding Theme	Permanent deletion of the tenant's company branding (sign-in customization).	N	N
Update Branding Theme	Records a change to a company branding theme that customizes the Entra sign-in experience.	N	N

Create Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

A company-branding theme was created. A theme customizes the Microsoft Entra sign-in experience, including background image or color, favicon, layout, header, and footer, and can be applied per application.

References #

Delete Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records the deletion of a company branding theme, a set of sign-in page customizations (logos, colors, layout, text) that can be applied to selected applications. Removing a theme reverts affected apps to default or inherited sign-in branding.

References #

Hard Delete Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records the permanent (hard) deletion of the organization's company branding configuration, which customizes the Microsoft Entra sign-in experience (background image or color, logo, favicon, layout, header, and footer).

References #

Update Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records a change to a company branding theme, which customizes the Microsoft Entra sign-in experience (layout, background, logos, header, and footer) and can be applied to specific applications. Modified sign-in branding is occasionally noted as a phishing-enabler concern.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.