Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: CrossTenantIdentitySyncSettings

OperationName	Description	Sample	Rule
Create a partner cross-tenant identity sync setting	A partner cross-tenant identity synchronization setting was created.	N	N
Delete a partner cross-tenant identity sync setting	Deletion of a partner's cross-tenant synchronization (identity sync) setting controlling inbound B2B user/group provisioning.	N	N
Update a partner cross-tenant identity sync setting	Inbound cross-tenant synchronization settings for a specific partner (allow user/group sync into this tenant) were updated.	N	N

Create a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records the creation of a cross-tenant identity synchronization setting for a partner tenant, which configures automated provisioning of B2B collaboration users (and groups) between a source and target tenant. Inbound cross-tenant sync can introduce externally controlled accounts and is relevant to monitoring for persistence and lateral movement across tenants.

Delete a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records deletion of a partner-specific cross-tenant synchronization (identity sync) setting, which governs whether B2B collaboration users and groups are automatically created, updated, and deleted in the tenant from that partner. Removing it stops or resets the inbound provisioning trust for that partner.

Update a partner cross-tenant identity sync setting

Source: Microsoft Entra ID audit log
Audit Category: CrossTenantIdentitySyncSettings

Description

Records a change to the inbound cross-tenant synchronization settings for a specific partner tenant, the target-tenant 'Allow users sync into this tenant' and 'Allow groups sync into this tenant' controls that permit a partner's source tenant to provision B2B users and groups into this tenant. Enabling it allows external accounts to be created, updated, and deleted automatically across the tenant boundary.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.