detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Device

OperationNameDescriptionSampleRule
Add deviceA device object was added to the directory.YY
Add registered owner to deviceA registered owner was added to a device.YY
Add registered users to deviceRegistered users were added to a device.NY
Delete deviceA device object was deleted.NY
Register deviceA device was registered or joined to Entra ID.NY
Update deviceA device object was modified.YY
Delete pre-created deviceDeletion of a pre-created device object registered in an Azure AD B2C tenant.NN
Device no longer compliantA device's compliance state changed to non-compliant in Microsoft Entra ID.NY
Device no longer managedA device's management state changed to unmanaged in Microsoft Entra ID.NY
Hard Delete devicePermanent deletion of an Entra device object; BitLocker/LAPS data lost and unrecoverable.NN
Pre-create deviceA device object was pre-created (pre-registered) in the directory before enrollment or join.NN
Recover device local administrator passwordA device's Windows LAPS-managed local administrator password was retrieved from Microsoft Entra ID.NN
Remove registered owner from deviceThe registered owner was removed from a Microsoft Entra device object.NN
Remove registered users from deviceOne or more registered users were removed from a Microsoft Entra device object.NN
Restore deviceA soft-deleted device object was restored to the active directory.NN
Unregister deviceA device was unregistered, removing its directory device object.NN
Update device local administrator passwordA device's Windows LAPS local administrator password was updated (rotated) in Entra ID.NN
Update local administrator passwordWindows LAPS-managed local administrator password updated/backed up to Entra ID (e.g., rotation).NN

Add device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device object was added to the directory.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.2171727Z",
  "ActivityDisplayName": "Add device",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "69949ca7-71d3-4dee-bb88-6d2ce44529e3",
  "DurationMs": "0",
  "Id": "Directory_69949ca7-71d3-4dee-bb88-6d2ce44529e3_G0SO4_120748367",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Add device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": "zzcap-device-001",
      "type": "Device",
      "modifiedProperties": [
        {
          "displayName": "AccountEnabled",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "CloudAccountEnabled",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "CloudDeviceOSType",
          "oldValue": [],
          "newValue": [
            "Windows"
          ]
        },
        {
          "displayName": "CloudDeviceOSVersion",
          "oldValue": [],
          "newValue": [
            "10.0.22631"
          ]
        },
        {
          "displayName": "CloudDisplayName",
          "oldValue": [],
          "newValue": [
            "zzcap-device-001"
          ]
        },
        {
          "displayName": "CloudCreated",
          "oldValue": [],
          "newValue": [
            true
          ]
        },
        {
          "displayName": "DeviceId",
          "oldValue": [],
          "newValue": [
            "7d9f806c-db56-423b-b3fb-cda0d7339554"
          ]
        },
        {
          "displayName": "DeviceOSType",
          "oldValue": [],
          "newValue": [
            "Windows"
          ]
        },
        {
          "displayName": "DeviceOSVersion",
          "oldValue": [],
          "newValue": [
            "10.0.22631"
          ]
        },
        {
          "displayName": "DisplayName",
          "oldValue": [],
          "newValue": [
            "zzcap-device-001"
          ]
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"AccountEnabled, CloudAccountEnabled, CloudDeviceOSType, CloudDeviceOSVersion, CloudDisplayName, CloudCreated, DeviceId, DeviceOSType, DeviceOSVersion, DisplayName\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.2171727Z",
  "Type": "AuditLogs"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
EventType (elastic rule field)eqadd device2 ruleselastic
azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value (elastic rule field)containsdesktop-2 ruleselastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Entra ID Device Registration with Phishing Kit Default OS Build source medium: Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher "10.0.19045.<revision>" value.T1098, T1098.005
  • Entra ID Device Registration with ROADtools Default OS Build source high: Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19041.928" and the device display name follows the default "DESKTOP-" pattern. This combination is the default device profile that ROADtools (roadtx) uses when registering a device, and it is uncommon for the OS build to match the hardcoded value across an environment of otherwise patched hosts. Adversaries register rogue devices in Entra ID to acquire a Primary Refresh Token (PRT), establish persistence, and obtain trusted, programmatic access to the tenant. Because the OS build is a tool default, this is a high-fidelity but evadable indicator; baseline approved provisioning tooling and device naming conventions before relying on it.T1098, T1098.005
  • Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add registered owner to device, Add registered users to device

References #

Add registered owner to device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A registered owner was added to a device.

Example Audit Log Entry #

{
  "AADOperationType": "Assign",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.6109542Z",
  "ActivityDisplayName": "Add registered owner to device",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "7c4914ef-8d1c-41ee-b88b-df0eb1683f5a",
  "DurationMs": "0",
  "Id": "Directory_7c4914ef-8d1c-41ee-b88b-df0eb1683f5a_ER07J_154109879",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Add registered owner to device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000014",
      "displayName": null,
      "type": "User",
      "modifiedProperties": [
        {
          "displayName": "Device.ObjectID",
          "oldValue": null,
          "newValue": "\"aaaaaaaa-0000-0000-0000-000000000016\""
        },
        {
          "displayName": "Device.DisplayName",
          "oldValue": null,
          "newValue": "\"zzcap-device-001\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic",
      "userPrincipalName": "zzcap-user-002@example.onmicrosoft.com"
    },
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": null,
      "type": "Device",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.6109542Z",
  "Type": "AuditLogs"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add device, Add registered users to device

References #

Add registered users to device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Registered users were added to a device.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Entra ID Unusual Cloud Device Registration source medium: Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the Microsoft.OData.Client user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.T1098, T1098.005↳ also matches Add device, Add registered owner to device

References #

Delete device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device object was deleted.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

Register device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device was registered or joined to Entra ID.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
azure.signinlogs.properties.device_detail.is_managed (elastic rule field)netrue1 ruleelastic
azure.signinlogs.properties.incoming_token_type (elastic rule field)eqprimaryRefreshToken1 ruleelastic
azure.signinlogs.properties.incoming_token_type (elastic rule field)eqrefreshToken1 ruleelastic
azure.signinlogs.properties.is_interactive (elastic rule field)eqtrue1 ruleelastic
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status (elastic rule field)equnbound1 ruleelastic
azure.signinlogs.result_signature (elastic rule field)eqSUCCESS1 ruleelastic
azure_ad::app_id (elastic rule field)eq29d9ed98-a469-4536-ade2-f981bc1d605e1 ruleelastic
azure_ad::resource_display_name (elastic rule field)neDevice Registration Service1 ruleelastic
azure_ad::signin_category (elastic rule field)eqNonInteractiveUserSignInLogs1 ruleelastic
azure_ad::user_type (elastic rule field)eqMember1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Entra ID AiTM Phishing-Kit Chain Detected source high: Identifies a Microsoft Entra ID identity-compromise chain in which a single user, within a 10-minute window, authenticates to the Device Registration Service through the Microsoft Authentication Broker (MAB) client, registers a device, and then uses the resulting Primary Refresh Token (PRT) to access a resource other than the Device Registration Service. This sequence is the core post-adversary-in-the-middle (AiTM) persistence pattern used by phishing kits such as Tycoon2FA and Kali365: after capturing a victim session, the kit registers an Azure AD-joined device to obtain a device-bound PRT, which survives user-level session revocation and password resets and grants trusted, MFA-free access. Correlating the broker sign-in, the device-registration audit event, and the follow-on PRT sign-in for the same user within a short window is a high-fidelity indicator of active account takeover.T1078, T1078.004, T1098, T1098.005, T1528, T1550
  • Entra ID Multiple Device Registrations by a Single User source medium: Detects multiple Microsoft Entra ID device registrations by a single user, where three or more distinct devices are registered within a 15-minute window. A legitimate user enrolling a device produces a single "Register device" event; registering multiple distinct devices in quick succession is uncommon and is the fingerprint behavior of adversary-in-the-middle (AiTM) phishing kits and stolen-token replay tooling (for example Kali365), which mint a new Azure AD-joined device, and therefore a new Primary Refresh Token (PRT), per relay or replay attempt. Each registered device is a separate certificate-bound principal whose PRT survives user-level session revocation and password resets, so multiple registrations on a single low-privilege identity establish device-bound persistence at scale.T1078, T1078.004, T1098, T1098.005, T1557
  • Entra ID Register Device with Unusual User Agent (Azure AD Join) source medium: Detects successful Microsoft Entra ID audit events for Register device where additional details indicate an Azure AD join and the recorded user agent is not one of the common native registration clients (Dsreg, DeviceRegistrationClient, or Dalvik-based Android enrollment). Legitimate Windows and standard mobile enrollment flows often present predictable user-agent strings; unexpected clients may reflect scripted registration, third-party tooling, or adversary-driven device registration used for persistence or token abuse. Baseline approved provisioning tools and MDM integrations before tuning.T1098, T1098.005

Show 1 more (4 total) on the rules page

References #

Update device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device object was modified.

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-06-29T17:34:58.6079582Z",
  "ActivityDisplayName": "Update device",
  "AdditionalDetails": [
    {
      "key": "DeviceId",
      "value": "7d9f806c-db56-423b-b3fb-cda0d7339554"
    },
    {
      "key": "DeviceOSType",
      "value": "Windows"
    },
    {
      "key": "DeviceTrustType",
      "value": ""
    },
    {
      "key": "User-Agent",
      "value": "Python-urllib/3.11"
    }
  ],
  "Category": "Device",
  "CorrelationId": "7c4914ef-8d1c-41ee-b88b-df0eb1683f5a",
  "DurationMs": "0",
  "Id": "Directory_7c4914ef-8d1c-41ee-b88b-df0eb1683f5a_ER07J_154109857",
  "Identity": "",
  "InitiatedBy": {
    "user": {
      "displayName": null,
      "agentType": "notAgentic",
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": []
    }
  },
  "Level": "",
  "Location": "",
  "LoggedByService": "Core Directory",
  "OperationName": "Update device",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceProvider": "",
  "Result": "success",
  "ResultDescription": "",
  "ResultReason": "",
  "ResultSignature": "None",
  "ResultType": "",
  "SourceSystem": "Azure AD",
  "TargetResources": [
    {
      "id": "aaaaaaaa-0000-0000-0000-000000000016",
      "displayName": "zzcap-device-001",
      "type": "Device",
      "modifiedProperties": [
        {
          "displayName": "TargetId.DeviceId",
          "oldValue": null,
          "newValue": "\"7d9f806c-db56-423b-b3fb-cda0d7339554\""
        },
        {
          "displayName": "TargetId.DeviceOSType",
          "oldValue": null,
          "newValue": "\"Windows\""
        },
        {
          "displayName": "TargetId.DeviceTrustType",
          "oldValue": null,
          "newValue": "\"\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ],
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:34:58.6079582Z",
  "Type": "AuditLogs"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
displayName (kusto rule field)eqincluded updated properties1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Kusto #

References #

Delete pre-created device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records the deletion of a pre-created device object registered in an Azure AD B2C tenant.

References #

Device no longer compliant

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that a device's compliance state in Microsoft Entra ID changed to non-compliant, typically reported through the mobile device management integration. The change can affect Conditional Access policies that require a compliant device.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

Device no longer managed

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that a device's management state in Microsoft Entra ID changed to unmanaged, typically when it stops being managed by mobile device management. The change can affect Conditional Access policies that require a managed device.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

Hard Delete device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records the permanent (hard) deletion of a device object from Microsoft Entra ID, after which associated data such as BitLocker recovery keys and LAPS passwords is permanently lost and the device object must be recreated. A hard delete occurs when a soft-deleted device is not restored within 30 days, an administrator explicitly permanently deletes a soft-deleted device, or the device type does not support soft delete.

References #

Pre-create device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records the pre-creation (pre-registration) of a device object in the directory, establishing a device identity before the device actually enrolls or joins.

References #

Recover device local administrator password

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device's Windows LAPS-managed local administrator password was retrieved from Microsoft Entra ID. Because it exposes a privileged local credential, an unexpected or repeated recovery is relevant to credential-access and lateral-movement monitoring.

References #

Remove registered owner from device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that the registered owner was removed from a Microsoft Entra device object, dissociating the user account recorded as that device's registered owner.

References #

Remove registered users from device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that one or more registered users were removed from a Microsoft Entra device object.

References #

Restore device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that a soft-deleted device object was restored, moving it out of the soft-deleted container back to the active directory so it can authenticate and be managed again. Soft-deleted devices are recoverable for 30 days and retain their identity, key material, BitLocker recovery keys, and LAPS passwords, so a restore reinstates a device identity that can again access Entra-protected resources.

References #

Unregister device

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that a device registration was removed (unregistered) from the directory, removing the directory device object. Loss of a registered or compliant device can affect device-based Conditional Access, and unexpected unregistration may reflect cleanup of attacker-controlled devices or tampering with device trust.

References #

Update device local administrator password

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

A device's Windows LAPS managed local administrator password was updated (rotated) and backed up to Microsoft Entra ID. Monitoring these events helps detect unexpected local-credential changes.

References #

Update local administrator password

#
Source
Microsoft Entra ID audit log
Audit Category
Device

Description

Records that a Windows device's local administrator password managed by Windows LAPS was updated and backed up to Microsoft Entra ID (for example, a scheduled rotation). Retrieval of the stored password is logged separately as a recover event, so these records support monitoring of local-admin credential lifecycle.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.