Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CompanyBranding

OperationName	Description	Sample	Rule
Create Branding Theme	A company-branding theme was created to customize the sign-in experience (background, logo, layout, header, footer).	N	N
Delete Branding Theme	A company branding theme was deleted.	N	N
Hard Delete Branding Theme	Permanent deletion of the tenant's company branding (sign-in customization).	N	N
Update Branding Theme	Records a change to a company branding theme that customizes the Entra sign-in experience.	N	N

Create Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

A company-branding theme was created. A theme customizes the Microsoft Entra sign-in experience, including background image or color, favicon, layout, header, and footer, and can be applied per application.

References #

Delete Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records the deletion of a company branding theme, a set of sign-in page customizations (logos, colors, layout, text) that can be applied to selected applications. Removing a theme reverts affected apps to default or inherited sign-in branding.

References #

Hard Delete Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records the permanent (hard) deletion of the organization's company branding configuration, which customizes the Microsoft Entra sign-in experience (background image or color, logo, favicon, layout, header, and footer).

References #

Update Branding Theme

Source: Microsoft Entra ID audit log
Audit Category: CompanyBranding

Description

Records a change to a company branding theme, which customizes the Microsoft Entra sign-in experience (layout, background, logos, header, and footer) and can be applied to specific applications. Modified sign-in branding is occasionally noted as a phishing-enabler concern.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.