Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: DeviceConfiguration
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Add device configuration | A device configuration object was added to the directory. | N | N |
| Delete device configuration | Deletion of a device configuration object in the directory (Core Directory device settings). | N | Y |
| Update device configuration | Tenant-level Entra device registration/configuration settings were updated. | N | Y |
Add device configuration
#Description
A device configuration object was added to the directory. This Core Directory operation records creation of directory-level device configuration and appears alongside the matching update and delete device configuration operations.
References #
Delete device configuration
#Description
A device configuration object was deleted from the directory. The DeviceConfiguration category in Core Directory covers tenant device registration and related device directory settings, but the specific object removed is not established from the operation name alone.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1565, T1565.001↳ also matches Delete device, Update device, Update device configuration
References #
Update device configuration
#Description
The tenant's device configuration was updated in Microsoft Entra ID: the directory-level settings that govern device registration and join, such as which users may register or join devices.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1565, T1565.001↳ also matches Delete device, Update device, Delete device configuration
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.