Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CompanyBrandingLocale

OperationName	Description	Sample	Rule
Create Branding Theme Localization	A language localization was added to a company-branding theme.	N	N
Delete Branding Theme Localization	A localized (language-specific) variant of a company branding theme was deleted.	N	N
Hard Delete Branding Theme Localization	Permanent deletion of a per-language company branding (locale) customization.	N	N
Update Branding Theme Localization	Records a change to a language-specific localization of a company branding theme.	N	N

Create Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

A language-specific localization was added to a company-branding theme, supplying localized sign-in customization for a particular language. Custom text that is not set per language is not localized and falls back to the default theme text.

References #

Delete Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records the deletion of a language-specific (localized) variant of a company branding theme. Each theme can carry per-language customizations of sign-in text and assets; this operation removes one such localization while leaving the base theme intact.

References #

Hard Delete Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records the permanent (hard) deletion of a language-specific company branding customization, the per-locale variant of the tenant's sign-in branding shown to users whose browser language matches that locale.

References #

Update Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records a change to a language-specific localization of a company branding theme, overriding sign-in branding elements (such as text, logos, and colors) for a particular locale. Unspecified properties fall back to the theme or default branding.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.