Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CrossTenantAccessSettings

OperationName	Description	Sample	Rule
Add a partner to cross-tenant access setting	A partner organization was added to the cross-tenant access settings; the partner tenant id appears in modified properties. Key cross-tenant synchronization abuse signal.	Y	N
Delete partner specific cross-tenant access setting	A partner organization's customized cross-tenant access settings were removed, reverting that partner to the default settings.	Y	N
Update a partner cross-tenant access setting	Inbound, outbound, or trust settings for a partner organization's cross-tenant access policy were modified.	Y	N
Add a domain-based partner to cross-tenant access setting	An external organization (by domain or tenant ID) was added to cross-tenant access settings as an org-specific B2B trust entry.	N	N
Delete a domain-based partner to cross-tenant access setting	Deletion of a domain-based partner entry from cross-tenant access (B2B) settings, reverting that partner to default settings.	N	N
Migrated partner cross-tenant access settings to the scalable model	An automated task migrated a partner's cross-tenant access settings to the new scalable storage model.	N	N
Reset the cross-tenant access default setting	The tenant's cross-tenant access default settings were reset to the Microsoft service-default configuration.	N	N
Update a domain-based partner to cross-tenant access setting	Organization-specific cross-tenant access settings for a domain/tenant-identified partner were updated.	N	N
Update the company default cross-tenant access setting	Default company-wide cross-tenant access settings changed: inbound/outbound B2B access + trust of external MFA/device claims.	N	N

Add a partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

A partner organization was added to the cross-tenant access settings; the partner tenant id appears in modified properties. Key cross-tenant synchronization abuse signal.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:06.1785183Z",
  "ActivityDisplayName": "Add a partner to cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "9ed95322-5215-4044-b60a-f22d1e7ca928",
  "DurationMs": "0",
  "Id": "Directory_9ed95322-5215-4044-b60a-f22d1e7ca928_NDX5U_142743734",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add a partner to cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": null,
          "newValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Delete partner specific cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

A partner organization's customized cross-tenant access settings were removed, reverting that partner to the default settings.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:07.8783418Z",
  "ActivityDisplayName": "Delete partner specific cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "fb441ec9-cea7-4984-a0c6-e9f164b71ddb",
  "DurationMs": "0",
  "Id": "Directory_fb441ec9-cea7-4984-a0c6-e9f164b71ddb_3U00I_146357333",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Delete partner specific cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\"",
          "newValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Update a partner cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Inbound, outbound, or trust settings for a partner organization's cross-tenant access policy were modified.

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:06.9805114Z",
  "ActivityDisplayName": "Update a partner cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "f2ec71e8-59a0-4ab2-acf5-89a67651e670",
  "DurationMs": "0",
  "Id": "Directory_f2ec71e8-59a0-4ab2-acf5-89a67651e670_40I52_145042047",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Update a partner cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "automaticUserConsentSettings",
          "oldValue": {
            "InboundAllowed": null,
            "OutboundAllowed": null
          },
          "newValue": {
            "InboundAllowed": false,
            "OutboundAllowed": false
          }
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Add a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

An external Microsoft Entra organization, identified by its domain name (or tenant ID), was added to the tenant's cross-tenant access settings. This creates an organization-specific entry whose inbound and outbound B2B collaboration and B2B direct connect trust can then diverge from the defaults; expanding cross-tenant trust can broaden external access to tenant resources.

References #

Delete a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records deletion of a domain-based partner entry from the tenant's cross-tenant access settings, removing the partner-specific inbound/outbound B2B collaboration and trust configuration scoped to that organization. After removal the partner falls back to the tenant's default cross-tenant access settings, which can broaden or narrow external access.

References #

Migrated partner cross-tenant access settings to the scalable model

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records that an automated Microsoft Entra task migrated a partner's cross-tenant access settings to the new scalable storage model, which removes the prior 25 KB storage cap and the limit on the number of partner organizations. It is a system-initiated migration rather than an administrator change, so the entry is generally benign.

References #

Reset the cross-tenant access default setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records that the tenant's cross-tenant access default settings were reset to the Microsoft service-default configuration. The default settings govern inbound and outbound B2B collaboration and B2B direct connect for any external Microsoft Entra organization that has no explicit organization-specific setting, so changes to them affect which external tenants can collaborate and are relevant to external-access governance.

References #

Update a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records a change to the organization-specific (partner) cross-tenant access settings for an external Microsoft Entra organization identified by domain or tenant ID. These settings govern inbound and outbound B2B collaboration and direct-connect access and the trust of the partner's MFA and device claims, so loosening them (for example, trusting partner MFA or enabling automatic invitation redemption) expands cross-tenant access and is security-relevant.

References #

Update the company default cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

The tenant's default (company-wide) cross-tenant access settings were changed. These defaults apply to every external Microsoft Entra organization without an organization-specific override and govern inbound/outbound B2B collaboration access plus trust of external multifactor-authentication and device-compliance claims. Loosening the defaults (allowing access or trusting external MFA/device claims) expands external reachability and weakens isolation, relevant to access-expansion and trust-weakening detection.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.