detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Contact

OperationNameDescriptionSampleRule
Add contactAn organizational contact object was added to the directory.NN
Delete contactAn organizational contact (directory contact object) was deleted.NN
Update contactChange to an organizational (directory) contact object.NN

Add contact

#
Source
Microsoft Entra ID audit log
Audit Category
Contact

Description

An organizational contact object was added to the directory. Organizational contacts represent people external to the directory (for example, mail contacts) rather than sign-in-capable user accounts.

References #

Delete contact

#
Source
Microsoft Entra ID audit log
Audit Category
Contact

Description

An organizational contact was deleted from the directory. Organizational contacts are admin-managed directory objects (such as mail-enabled contacts), distinct from a tenant's user accounts and from users' personal contacts.

References #

Update contact

#
Source
Microsoft Entra ID audit log
Audit Category
Contact

Description

Records a change to an organizational contact (a mail-enabled directory contact object) in Microsoft Entra ID. Organizational contacts represent people external to the directory and may be synchronized from on-premises; an update modifies the contact's directory attributes.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.