Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: DeviceConfiguration
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Add device configuration | A device configuration object was added to the directory. | N | N |
| Delete device configuration | Deletion of a device configuration object in the directory (Core Directory device settings). | N | Y |
| Update device configuration | Tenant-level Entra device registration/configuration settings were updated. | N | Y |
Add device configuration
#Description
A device configuration object was added to the directory. This Core Directory operation records creation of directory-level device configuration and appears alongside the matching update and delete device configuration operations.
References #
Delete device configuration
#Description
A device configuration object was deleted from the directory. The DeviceConfiguration category in Core Directory covers tenant device registration and related device directory settings, but the specific object removed is not established from the operation name alone.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
OperationName | 1 detection rule | Sigma |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1565, T1565.001↳ also matches Delete device, Update device, Update device configuration
References #
Update device configuration
#Description
The tenant's device configuration was updated in Microsoft Entra ID: the directory-level settings that govern device registration and join, such as which users may register or join devices.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
OperationName | 1 detection rule | Sigma |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1565, T1565.001↳ also matches Delete device, Update device, Delete device configuration
References #
Computed Fields in AuditLogs #
Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.
Initiating*values come fromInitiatedBy:InitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, orInitiatedBy.user.id; application actors useInitiatedBy.app.displayNameorInitiatedBy.app.appId.- Change details come from
TargetResources[].modifiedProperties. ExpandTargetResourcesbefore usingdisplayName,oldValue, ornewValue.
Sources: the AuditLogs table reference and Graph directoryAudit resource.