Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CrossTenantAccessSettings

OperationName	Description	Sample	Rule
Add a partner to cross-tenant access setting	A partner organization was added to the cross-tenant access settings; the partner tenant id appears in modified properties. Key cross-tenant synchronization abuse signal.	Y	N
Delete partner specific cross-tenant access setting	A partner organization's customized cross-tenant access settings were removed, reverting that partner to the default settings.	Y	N
Update a partner cross-tenant access setting	Inbound, outbound, or trust settings for a partner organization's cross-tenant access policy were modified.	Y	N
Add a domain-based partner to cross-tenant access setting	An external organization (by domain or tenant ID) was added to cross-tenant access settings as an org-specific B2B trust entry.	N	N
Delete a domain-based partner to cross-tenant access setting	Deletion of a domain-based partner entry from cross-tenant access (B2B) settings, reverting that partner to default settings.	N	N
Migrated partner cross-tenant access settings to the scalable model	An automated task migrated a partner's cross-tenant access settings to the new scalable storage model.	N	N
Reset the cross-tenant access default setting	The tenant's cross-tenant access default settings were reset to the Microsoft service-default configuration.	N	N
Update a domain-based partner to cross-tenant access setting	Organization-specific cross-tenant access settings for a domain/tenant-identified partner were updated.	N	N
Update the company default cross-tenant access setting	Default company-wide cross-tenant access settings changed: inbound/outbound B2B access + trust of external MFA/device claims.	N	N

Add a partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

A partner organization was added to the cross-tenant access settings; the partner tenant id appears in modified properties. Key cross-tenant synchronization abuse signal.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:06.1785183Z",
  "ActivityDisplayName": "Add a partner to cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "9ed95322-5215-4044-b60a-f22d1e7ca928",
  "DurationMs": "0",
  "Id": "Directory_9ed95322-5215-4044-b60a-f22d1e7ca928_NDX5U_142743734",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add a partner to cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": null,
          "newValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Delete partner specific cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

A partner organization's customized cross-tenant access settings were removed, reverting that partner to the default settings.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:07.8783418Z",
  "ActivityDisplayName": "Delete partner specific cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "fb441ec9-cea7-4984-a0c6-e9f164b71ddb",
  "DurationMs": "0",
  "Id": "Directory_fb441ec9-cea7-4984-a0c6-e9f164b71ddb_3U00I_146357333",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Delete partner specific cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\"",
          "newValue": "\"f8cdef31-a31e-4b4a-93e4-5f571e91255a\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Update a partner cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Inbound, outbound, or trust settings for a partner organization's cross-tenant access policy were modified.

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:06.9805114Z",
  "ActivityDisplayName": "Update a partner cross-tenant access setting",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "CrossTenantAccessSettings",
  "CorrelationId": "f2ec71e8-59a0-4ab2-acf5-89a67651e670",
  "DurationMs": "0",
  "Id": "Directory_f2ec71e8-59a0-4ab2-acf5-89a67651e670_40I52_145042047",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Update a partner cross-tenant access setting",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "f40b0cd7-620d-45a7-a5e3-d3ee4a0a1eef",
      "displayName": "CrossTenantAccessPolicy for 11111111-1111-1111-1111-111111111111",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "automaticUserConsentSettings",
          "oldValue": {
            "InboundAllowed": null,
            "OutboundAllowed": null
          },
          "newValue": {
            "InboundAllowed": false,
            "OutboundAllowed": false
          }
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Add a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

An external Microsoft Entra organization, identified by its domain name (or tenant ID), was added to the tenant's cross-tenant access settings. This creates an organization-specific entry whose inbound and outbound B2B collaboration and B2B direct connect trust can then diverge from the defaults; expanding cross-tenant trust can broaden external access to tenant resources.

References #

Delete a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records deletion of a domain-based partner entry from the tenant's cross-tenant access settings, removing the partner-specific inbound/outbound B2B collaboration and trust configuration scoped to that organization. After removal the partner falls back to the tenant's default cross-tenant access settings, which can broaden or narrow external access.

References #

Migrated partner cross-tenant access settings to the scalable model

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records that an automated Microsoft Entra task migrated a partner's cross-tenant access settings to the new scalable storage model, which removes the prior 25 KB storage cap and the limit on the number of partner organizations. It is a system-initiated migration rather than an administrator change, so the entry is generally benign.

References #

Reset the cross-tenant access default setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records that the tenant's cross-tenant access default settings were reset to the Microsoft service-default configuration. The default settings govern inbound and outbound B2B collaboration and B2B direct connect for any external Microsoft Entra organization that has no explicit organization-specific setting, so changes to them affect which external tenants can collaborate and are relevant to external-access governance.

References #

Update a domain-based partner to cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

Records a change to the organization-specific (partner) cross-tenant access settings for an external Microsoft Entra organization identified by domain or tenant ID. These settings govern inbound and outbound B2B collaboration and direct-connect access and the trust of the partner's MFA and device claims, so loosening them (for example, trusting partner MFA or enabling automatic invitation redemption) expands cross-tenant access and is security-relevant.

References #

Update the company default cross-tenant access setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantAccessSettings

Description

The tenant's default (company-wide) cross-tenant access settings were changed. These defaults apply to every external Microsoft Entra organization without an organization-specific override and govern inbound/outbound B2B collaboration access plus trust of external multifactor-authentication and device-compliance claims. Loosening the defaults (allowing access or trusting external MFA/device claims) expands external reachability and weakens isolation, relevant to access-expansion and trust-weakening detection.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.