Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CompanyBrandingLocale

OperationName	Description	Sample	Rule
Create Branding Theme Localization	A language localization was added to a company-branding theme.	N	N
Delete Branding Theme Localization	A localized (language-specific) variant of a company branding theme was deleted.	N	N
Hard Delete Branding Theme Localization	Permanent deletion of a per-language company branding (locale) customization.	N	N
Update Branding Theme Localization	Records a change to a language-specific localization of a company branding theme.	N	N

Create Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

A language-specific localization was added to a company-branding theme, supplying localized sign-in customization for a particular language. Custom text that is not set per language is not localized and falls back to the default theme text.

References #

Delete Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records the deletion of a language-specific (localized) variant of a company branding theme. Each theme can carry per-language customizations of sign-in text and assets; this operation removes one such localization while leaving the base theme intact.

References #

Hard Delete Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records the permanent (hard) deletion of a language-specific company branding customization, the per-locale variant of the tenant's sign-in branding shown to users whose browser language matches that locale.

References #

Update Branding Theme Localization

Source: Microsoft Entra ID audit log
Audit Category: CompanyBrandingLocale

Description

Records a change to a language-specific localization of a company branding theme, overriding sign-in branding elements (such as text, logos, and colors) for a particular locale. Unspecified properties fall back to the theme or default branding.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.