Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: DelegatedAdminServiceProviderConstraints

OperationName	Description	Sample	Rule
Adding allowed assignable roles	Adds Entra roles to the set a delegated-admin (CSP/GDAP) partner may be assigned over the tenant.	N	N
Updating allowed assignable roles	The set of Entra roles assignable in a delegated-admin (GDAP) service-provider relationship was changed.	N	N
Deleting allowed assignable roles		Y	N

Adding allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Description

Records the addition of allowed assignable roles to a delegated-admin service-provider constraint, defining which Microsoft Entra roles a Cloud Solution Provider partner may be granted through a delegated admin (GDAP) relationship to administer the tenant on the customer's behalf. Widening the partner's permitted roles is privilege-escalation relevant for delegated-administration abuse.

References #

Updating allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Description

Records a change to the set of Microsoft Entra roles permitted to be assigned within a delegated-admin (GDAP) service-provider relationship. Under GDAP, a partner's security groups can only be granted the customer-approved Entra roles defined by this constraint, so modifying the allowed assignable roles changes the privileges a delegated partner can hold, relevant to partner/delegated-admin privilege-escalation monitoring.

References #

Deleting allowed assignable roles

Source: Microsoft Entra ID audit log
Audit Category: DelegatedAdminServiceProviderConstraints

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-23T17:12:18.1905006Z",
  "ActivityDisplayName": "Deleting allowed assignable roles",
  "AdditionalDetails": [],
  "Category": "DelegatedAdminServiceProviderConstraints",
  "CorrelationId": "b31670c4-c70f-44d8-b7e6-42837810d832",
  "DurationMs": "0",
  "Id": "Directory_b31670c4-c70f-44d8-b7e6-42837810d832_X35Z9_168182171",
  "Identity": "EntraGDAP",
  "InitiatedBy": {
    "app": {
      "appId": null,
      "displayName": "EntraGDAP",
      "servicePrincipalId": "032530c2-87c5-4132-a4ee-f6999efb3d01",
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Deleting allowed assignable roles",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "b4c546a4-7dac-46a6-a7dd-ed822a11efd3",
      "displayName": null,
      "type": "DelegatedAdminServiceProviderConstraints",
      "modifiedProperties": [
        {
          "displayName": "tenantId",
          "oldValue": "\"b4c546a4-7dac-46a6-a7dd-ed822a11efd3\"",
          "newValue": null
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.