Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Device

OperationName	Description	Sample	Rule
Add device	A device object was added to the directory.	Y	Y
Add registered owner to device	A registered owner was added to a device.	Y	Y
Add registered users to device	Registered users were added to a device.	Y	Y
Delete device	A device object was deleted.	N	Y
Register device	A device was registered or joined to Entra ID.	Y	Y
Update device	A device object was modified.	Y	Y
Delete pre-created device	Deletion of a pre-created device object registered in an Azure AD B2C tenant.	N	N
Device no longer compliant	A device's compliance state changed to non-compliant in Microsoft Entra ID.	N	Y
Device no longer managed	A device's management state changed to unmanaged in Microsoft Entra ID.	N	Y
Hard Delete device	Permanent deletion of an Entra device object; BitLocker/LAPS data lost and unrecoverable.	N	N
Pre-create device	A device object was pre-created (pre-registered) in the directory before enrollment or join.	N	N
Recover device local administrator password	A device's Windows LAPS-managed local administrator password was retrieved from Microsoft Entra ID.	N	N
Remove registered owner from device	The registered owner was removed from a Microsoft Entra device object.	N	N
Remove registered users from device	One or more registered users were removed from a Microsoft Entra device object.	N	N
Restore device	A soft-deleted device object was restored to the active directory.	N	N
Unregister device	A device was unregistered, removing its directory device object.	N	N
Update device local administrator password	A device's Windows LAPS local administrator password was updated (rotated) in Entra ID.	N	N
Update local administrator password	Windows LAPS-managed local administrator password updated/backed up to Entra ID (e.g., rotation).	N	N

Add device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device object was added to the directory.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActivityDisplayName`	4 detection rules	Elastic
`Identity`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.2171727Z",
  "ActivityDisplayName": "Add device",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "69949ca7-71d3-4dee-bb88-6d2ce44529e3",
  "DurationMs": "0",
  "Id": "Directory_69949ca7-71d3-4dee-bb88-6d2ce44529e3_G0SO4_120748367",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Add device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": "zzcap-device-001",
      "type": "Device",
      "modifiedProperties": [
        {
          "displayName": "AccountEnabled",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "CloudAccountEnabled",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "CloudDeviceOSType",
          "oldValue": [],
          "newValue": [
            "Windows"
          ]
        },
        {
          "displayName": "CloudDeviceOSVersion",
          "oldValue": [],
          "newValue": [
            "10.0.22631"
          ]
        },
        {
          "displayName": "CloudDisplayName",
          "oldValue": [],
          "newValue": [
            "zzcap-device-001"
          ]
        },
        {
          "displayName": "CloudCreated",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "DeviceId",
          "oldValue": [],
          "newValue": [
            "7d9f806c-db56-423b-b3fb-cda0d7339554"
          ]
        },
        {
          "displayName": "DeviceOSType",
          "oldValue": [],
          "newValue": [
            "Windows"
          ]
        },
        {
          "displayName": "DeviceOSVersion",
          "oldValue": [],
          "newValue": [
            "10.0.22631"
          ]
        },
        {
          "displayName": "DisplayName",
          "oldValue": [],
          "newValue": [
            "zzcap-device-001"
          ]
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"AccountEnabled, CloudAccountEnabled, CloudDeviceOSType, CloudDeviceOSVersion, CloudDisplayName, CloudCreated, DeviceId, DeviceOSType, DeviceOSVersion, DisplayName\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.2171727Z",
  "Type": "AuditLogs"
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`Add device`	2 rules	elastic
`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value` (elastic rule field)	contains	`DESKTOP-`	2 rules	elastic
`azure.auditlogs.properties.initiated_by.user.id` (elastic rule field)	is_not_null		1 rule	elastic
`azure.signinlogs.result_signature` (elastic rule field)	eq	`SUCCESS`	1 rule	elastic
`azure_ad::user_type` (elastic rule field)	eq	`Member`	1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Device Registration with Phishing Kit Default OS Build source medium: Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher "10.0.19045.<revision>" value.T1098, T1098.005
Entra ID Device Registration with ROADtools Default OS Build source high: Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19041.928" and the device display name follows the default "DESKTOP-" pattern. This combination is the default device profile that ROADtools (roadtx) uses when registering a device, and it is uncommon for the OS build to match the hardcoded value across an environment of otherwise patched hosts. Adversaries register rogue devices in Entra ID to acquire a Primary Refresh Token (PRT), establish persistence, and obtain trusted, programmatic access to the tenant. Because the OS build is a tool default, this is a high-fidelity but evadable indicator; baseline approved provisioning tooling and device naming conventions before relying on it.T1098, T1098.005
Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add registered owner to device, Add registered users to device

Show 1 more (4 total) on the rules page

References #

Add registered owner to device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A registered owner was added to a device.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActivityDisplayName`	2 detection rules	Elastic

Example Audit Log Entry #

{
  "AADOperationType": "Assign",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.6109542Z",
  "ActivityDisplayName": "Add registered owner to device",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "7c4914ef-8d1c-41ee-b88b-df0eb1683f5a",
  "DurationMs": "0",
  "Id": "Directory_7c4914ef-8d1c-41ee-b88b-df0eb1683f5a_ER07J_154109879",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Add registered owner to device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000014",
      "displayName": null,
      "type": "User",
      "modifiedProperties": [
        {
          "displayName": "Device.ObjectID",
          "oldValue": null,
          "newValue": "\"aaaaaaaa-0000-0000-0000-000000000016\""
        },
        {
          "displayName": "Device.DisplayName",
          "oldValue": null,
          "newValue": "\"zzcap-device-001\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic",
      "userPrincipalName": "zzcap-user-002@example.onmicrosoft.com"
    },
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": null,
      "type": "Device",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.6109542Z",
  "Type": "AuditLogs"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.initiated_by.user.id` (elastic rule field)	is_not_null		1 rule	elastic
`azure.signinlogs.result_signature` (elastic rule field)	eq	`SUCCESS`	1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add device, Add registered users to device
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration source high: Identifies a Microsoft Entra ID device registration by the same user within 15 minutes of a phishing-resistant, device-bound credential (Windows Hello for Business, FIDO2 security key, or passkey) signing in with no device identifier. In the "borrowing Windows Hello keys" technique, an adversary reuses a WHfB/NGC key or passkey away from its bound device to mint device-agnostic tokens, then uses those tokens to register an attacker-controlled device and obtain a Primary Refresh Token (PRT) for long-lived persistence. Timing is taken from the authentication step on the sign-in, not the sign-in document timestamp, because Entra can emit the sign-in record after the Register device audit event. This chain is distinct from device-code-flow phishing kits.T1098, T1098.005, T1550↳ also matches Add device, Register device

References #

Add registered users to device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Registered users were added to a device.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActivityDisplayName`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "AADOperationType": "Assign",
  "AADTenantId": "00000000-0000-4000-8000-000000000074",
  "ActivityDisplayName": "Add registered users to device",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "redacted"
    }
  ],
  "Category": "Device",
  "CorrelationId": "00000000-0000-4000-8000-000000000047",
  "Identity": "user@example.com",
  "InitiatedBy": {
    "app": {
      "displayName": "Identity Redacted",
      "appId": null,
      "servicePrincipalId": "00000000-0000-4000-8000-00000000005d",
      "servicePrincipalName": null
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add registered users to device",
  "Result": "success",
  "TargetResources": [
    {
      "id": "00000000-0000-4000-8000-00000000004e",
      "displayName": null,
      "type": "User",
      "userPrincipalName": "user@example.com",
      "modifiedProperties": [
        {
          "displayName": "Device.ObjectID",
          "oldValue": null,
          "newValue": "redacted"
        },
        {
          "displayName": "Device.DisplayName",
          "oldValue": null,
          "newValue": "redacted"
        },
        {
          "displayName": "ActorId.ServicePrincipalNames",
          "oldValue": null,
          "newValue": "redacted"
        },
        {
          "displayName": "SPN",
          "oldValue": null,
          "newValue": "urn:ms-drs:tenant002.example;urn:ms-drs:tenant001.example;00000000-0000-4000-8000-00000000000c"
        }
      ],
      "administrativeUnits": []
    },
    {
      "id": "00000000-0000-4000-8000-0000000000bb",
      "displayName": null,
      "type": "Device",
      "modifiedProperties": [],
      "administrativeUnits": []
    }
  ]
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add device, Add registered owner to device

References #

Delete device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device object was deleted.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`OperationName`	1 detection rule	Sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Device or Configuration Modified or Deleted source medium: Identifies when a device or device configuration in azure is modified or deleted.T1485, T1565, T1565.001↳ also matches Update device, Delete device configuration, Update device configuration

References #

Register device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device was registered or joined to Entra ID.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActivityDisplayName`	5 detection rules	Elastic

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "00000000-0000-4000-8000-000000000074",
  "ActivityDisplayName": "Register device",
  "AdditionalDetails": [
    {
      "key": "AdditionalInfo",
      "value": "Successfully joined device using account type: User with identifier: 00000000-0000-4000-8000-00000000004e."
    },
    {
      "key": "Device Profile",
      "value": "redacted"
    },
    {
      "key": "Device Trust Type",
      "value": "redacted"
    },
    {
      "key": "Device OS",
      "value": "redacted"
    },
    {
      "key": "Device Id",
      "value": "redacted"
    }
  ],
  "Category": "Device",
  "CorrelationId": "00000000-0000-4000-8000-0000000000dd",
  "InitiatedBy": {
    "user": {
      "id": "00000000-0000-4000-8000-00000000004e",
      "displayName": null,
      "userPrincipalName": "user@example.com",
      "ipAddress": "203.0.113.31",
      "roles": []
    }
  },
  "LoggedByService": "Device Registration Service",
  "OperationName": "Register device",
  "Result": "success",
  "TargetResources": [
    {
      "id": null,
      "displayName": "Identity Redacted",
      "type": "Device",
      "modifiedProperties": [],
      "administrativeUnits": []
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`azure.auditlogs.properties.initiated_by.user.id` (elastic rule field)	is_not_null		2 rules	elastic
`azure.signinlogs.result_signature` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`Member`	2 rules	elastic
`azure.auditlogs.properties.initiated_by.user.userPrincipalName` (elastic rule field)	is_not_null		1 rule	elastic
`azure.signinlogs.properties.device_detail.is_managed` (elastic rule field)	ne	`true`	1 rule	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`primaryRefreshToken`	1 rule	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`refreshToken`	1 rule	elastic
`azure.signinlogs.properties.original_transfer_method` (elastic rule field)	eq	`deviceCodeFlow`	1 rule	elastic
`azure.signinlogs.properties.token_protection_status_details.sign_in_session_status` (elastic rule field)	eq	`unbound`	1 rule	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	1 rule	elastic
`azure_ad::resource_display_name` (elastic rule field)	ne	`Device Registration Service`	1 rule	elastic
`azure_ad::signin_category` (elastic rule field)	eq	`NonInteractiveUserSignInLogs`	1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID AiTM Phishing-Kit Chain Detected source high: Identifies a Microsoft Entra ID identity-compromise chain in which a single user, within a 10-minute window, authenticates to the Device Registration Service through the Microsoft Authentication Broker (MAB) client, registers a device, and then uses the resulting Primary Refresh Token (PRT) to access a resource other than the Device Registration Service. This sequence is the core post-adversary-in-the-middle (AiTM) persistence pattern used by phishing kits such as Tycoon2FA and Kali365: after capturing a victim session, the kit registers an Azure AD-joined device to obtain a device-bound PRT, which survives user-level session revocation and password resets and grants trusted, MFA-free access. Correlating the broker sign-in, the device-registration audit event, and the follow-on PRT sign-in for the same user within a short window is a high-fidelity indicator of active account takeover.T1078, T1078.004, T1098, T1098.005, T1528, T1550
Entra ID Multiple Device Registrations by a Single User source medium: Detects multiple Microsoft Entra ID device registrations by a single user, where three or more distinct devices are registered within a 15-minute window. A legitimate user enrolling a device produces a single "Register device" event; registering multiple distinct devices in quick succession is uncommon and is the fingerprint behavior of adversary-in-the-middle (AiTM) phishing kits and stolen-token replay tooling (for example Kali365), which mint a new Azure AD-joined device, and therefore a new Primary Refresh Token (PRT), per relay or replay attempt. Each registered device is a separate certificate-bound principal whose PRT survives user-level session revocation and password resets, so multiple registrations on a single low-privilege identity establish device-bound persistence at scale.T1078, T1078.004, T1098, T1098.005, T1557
Entra ID Register Device with Unusual User Agent (Azure AD Join) source medium: Detects successful Microsoft Entra ID audit events for Register device where additional details indicate an Azure AD join and the recorded user agent is not one of the common native registration clients (Dsreg, DeviceRegistrationClient, or Dalvik-based Android enrollment). Legitimate Windows and standard mobile enrollment flows often present predictable user-agent strings; unexpected clients may reflect scripted registration, third-party tooling, or adversary-driven device registration used for persistence or token abuse. Baseline approved provisioning tools and MDM integrations before tuning.T1098, T1098.005

Show 2 more (5 total) on the rules page

References #

Update device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device object was modified.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`OperationName`	2 detection rules	Kusto, Sigma

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.6079582Z",
  "ActivityDisplayName": "Update device",
  "AdditionalDetails": [
    {
      "key": "DeviceId",
      "value": "7d9f806c-db56-423b-b3fb-cda0d7339554"
    },
    {
      "key": "DeviceOSType",
      "value": "Windows"
    },
    {
      "key": "DeviceTrustType",
      "value": ""
    },
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "7c4914ef-8d1c-41ee-b88b-df0eb1683f5a",
  "DurationMs": "0",
  "Id": "Directory_7c4914ef-8d1c-41ee-b88b-df0eb1683f5a_ER07J_154109857",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Update device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": "zzcap-device-001",
      "type": "Device",
      "modifiedProperties": [
        {
          "displayName": "TargetId.DeviceId",
          "oldValue": null,
          "newValue": "\"7d9f806c-db56-423b-b3fb-cda0d7339554\""
        },
        {
          "displayName": "TargetId.DeviceOSType",
          "oldValue": null,
          "newValue": "\"Windows\""
        },
        {
          "displayName": "TargetId.DeviceTrustType",
          "oldValue": null,
          "newValue": "\"\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.6079582Z",
  "Type": "AuditLogs"
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Device or Configuration Modified or Deleted source medium: Identifies when a device or device configuration in azure is modified or deleted.T1485, T1565, T1565.001↳ also matches Delete device, Delete device configuration, Update device configuration

Kusto #

Suspicious Entra ID Joined Device Update source medium: This query looks for suspicious updates to an Microsoft Entra ID joined device where the device name is changed and the device falls out of compliance. This could occur when a threat actor updates the details of an Autopilot provisioned device using a stolen device ticket, in order to access certificates and keys. Ref: https://dirkjanm.io/assets/raw/Insomnihack Breaking and fixing Azure AD device identity security.pdfT1528

References #

Delete pre-created device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records the deletion of a pre-created device object registered in an Azure AD B2C tenant.

References #

Device no longer compliant

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that a device's compliance state in Microsoft Entra ID changed to non-compliant, typically reported through the mobile device management integration. The change can affect Conditional Access policies that require a compliant device.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`OperationName`	1 detection rule	Sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Device No Longer Managed or Compliant source medium: Identifies when a device in azure is no longer managed or compliant↳ also matches Device no longer managed

References #

Device no longer managed

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that a device's management state in Microsoft Entra ID changed to unmanaged, typically when it stops being managed by mobile device management. The change can affect Conditional Access policies that require a managed device.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`OperationName`	1 detection rule	Sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Device No Longer Managed or Compliant source medium: Identifies when a device in azure is no longer managed or compliant↳ also matches Device no longer compliant

References #

Hard Delete device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records the permanent (hard) deletion of a device object from Microsoft Entra ID, after which associated data such as BitLocker recovery keys and LAPS passwords is permanently lost and the device object must be recreated. A hard delete occurs when a soft-deleted device is not restored within 30 days, an administrator explicitly permanently deletes a soft-deleted device, or the device type does not support soft delete.

References #

Pre-create device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records the pre-creation (pre-registration) of a device object in the directory, establishing a device identity before the device actually enrolls or joins.

References #

Recover device local administrator password

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device's Windows LAPS-managed local administrator password was retrieved from Microsoft Entra ID. Because it exposes a privileged local credential, an unexpected or repeated recovery is relevant to credential-access and lateral-movement monitoring.

References #

Remove registered owner from device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that the registered owner was removed from a Microsoft Entra device object, dissociating the user account recorded as that device's registered owner.

References #

Remove registered users from device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that one or more registered users were removed from a Microsoft Entra device object.

References #

Restore device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that a soft-deleted device object was restored, moving it out of the soft-deleted container back to the active directory so it can authenticate and be managed again. Soft-deleted devices are recoverable for 30 days and retain their identity, key material, BitLocker recovery keys, and LAPS passwords, so a restore reinstates a device identity that can again access Entra-protected resources.

References #

Unregister device

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that a device registration was removed (unregistered) from the directory, removing the directory device object. Loss of a registered or compliant device can affect device-based Conditional Access, and unexpected unregistration may reflect cleanup of attacker-controlled devices or tampering with device trust.

References #

Update device local administrator password

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

A device's Windows LAPS managed local administrator password was updated (rotated) and backed up to Microsoft Entra ID. Monitoring these events helps detect unexpected local-credential changes.

References #

Update local administrator password

Source: Microsoft Entra ID audit log
Audit Category: Device

Description

Records that a Windows device's local administrator password managed by Windows LAPS was updated and backed up to Microsoft Entra ID (for example, a scheduled rotation). Retrieval of the stored password is logged separately as a recover event, so these records support monitoring of local-admin credential lifecycle.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.

Audit Logs: Device

Add device

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

Add registered owner to device

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

Add registered users to device

Description

Detection Fields #

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

References #

Delete device

Description

Detection Fields #

Related events #

Detection Rules #

Sigma #

References #

Register device

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

Update device

Description

Detection Fields #

Example Audit Log Entry #

Related events #

Detection Rules #

Sigma #

Kusto #

References #

Delete pre-created device

Description

References #

Device no longer compliant

Description

Detection Fields #

Related events #

Detection Rules #

Sigma #

References #

Device no longer managed

Description

Detection Fields #

Related events #

Detection Rules #

Sigma #

References #

Hard Delete device

Description

References #

Pre-create device

Description

References #

Recover device local administrator password

Description

References #

Remove registered owner from device

Description