Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CrossTenantIdentitySyncSettings

OperationName	Description	Sample	Rule
Create a partner cross-tenant identity sync setting	A partner cross-tenant identity synchronization setting was created.	N	N
Delete a partner cross-tenant identity sync setting	Deletion of a partner's cross-tenant synchronization (identity sync) setting controlling inbound B2B user/group provisioning.	N	N
Update a partner cross-tenant identity sync setting	Inbound cross-tenant synchronization settings for a specific partner (allow user/group sync into this tenant) were updated.	N	N

Create a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records the creation of a cross-tenant identity synchronization setting for a partner tenant, which configures automated provisioning of B2B collaboration users (and groups) between a source and target tenant. Inbound cross-tenant sync can introduce externally controlled accounts and is relevant to monitoring for persistence and lateral movement across tenants.

References #

Delete a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records deletion of a partner-specific cross-tenant synchronization (identity sync) setting, which governs whether B2B collaboration users and groups are automatically created, updated, and deleted in the tenant from that partner. Removing it stops or resets the inbound provisioning trust for that partner.

References #

Update a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records a change to the inbound cross-tenant synchronization settings for a specific partner tenant, the target-tenant 'Allow users sync into this tenant' and 'Allow groups sync into this tenant' controls that permit a partner's source tenant to provision B2B users and groups into this tenant. Enabling it allows external accounts to be created, updated, and deleted automatically across the tenant boundary.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.