Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Contact

OperationName	Description	Sample	Rule
Add contact	An organizational contact object was added to the directory.	N	N
Delete contact	An organizational contact (directory contact object) was deleted.	N	N
Update contact	Change to an organizational (directory) contact object.	N	N

Add contact

Source: Microsoft Entra ID audit log
Audit Category: Contact

Description

An organizational contact object was added to the directory. Organizational contacts represent people external to the directory (for example, mail contacts) rather than sign-in-capable user accounts.

References #

Delete contact

Source: Microsoft Entra ID audit log
Audit Category: Contact

Description

An organizational contact was deleted from the directory. Organizational contacts are admin-managed directory objects (such as mail-enabled contacts), distinct from a tenant's user accounts and from users' personal contacts.

References #

Update contact

Source: Microsoft Entra ID audit log
Audit Category: Contact

Description

Records a change to an organizational contact (a mail-enabled directory contact object) in Microsoft Entra ID. Organizational contacts represent people external to the directory and may be synchronized from on-premises; an update modifies the contact's directory attributes.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.