Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: DelegatedAdminServiceProviderConstraints

OperationName	Description	Sample	Rule
Adding allowed assignable roles	Adds Entra roles to the set a delegated-admin (CSP/GDAP) partner may be assigned over the tenant.	N	N
Updating allowed assignable roles	The set of Entra roles assignable in a delegated-admin (GDAP) service-provider relationship was changed.	N	N
Deleting allowed assignable roles		Y	N

Adding allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Description

Records the addition of allowed assignable roles to a delegated-admin service-provider constraint, defining which Microsoft Entra roles a Cloud Solution Provider partner may be granted through a delegated admin (GDAP) relationship to administer the tenant on the customer's behalf. Widening the partner's permitted roles is privilege-escalation relevant for delegated-administration abuse.

References #

Updating allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Description

Records a change to the set of Microsoft Entra roles permitted to be assigned within a delegated-admin (GDAP) service-provider relationship. Under GDAP, a partner's security groups can only be granted the customer-approved Entra roles defined by this constraint, so modifying the allowed assignable roles changes the privileges a delegated partner can hold, relevant to partner/delegated-admin privilege-escalation monitoring.

References #

Deleting allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-23T17:12:18.1905006Z",
  "ActivityDisplayName": "Deleting allowed assignable roles",
  "AdditionalDetails": [],
  "Category": "DelegatedAdminServiceProviderConstraints",
  "CorrelationId": "b31670c4-c70f-44d8-b7e6-42837810d832",
  "DurationMs": "0",
  "Id": "Directory_b31670c4-c70f-44d8-b7e6-42837810d832_X35Z9_168182171",
  "Identity": "EntraGDAP",
  "InitiatedBy": {
    "app": {
      "appId": null,
      "displayName": "EntraGDAP",
      "servicePrincipalId": "032530c2-87c5-4132-a4ee-f6999efb3d01",
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Deleting allowed assignable roles",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "b4c546a4-7dac-46a6-a7dd-ed822a11efd3",
      "displayName": null,
      "type": "DelegatedAdminServiceProviderConstraints",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": "\"b4c546a4-7dac-46a6-a7dd-ed822a11efd3\"",
          "newValue": null
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.