detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: DeviceManagement

OperationNameDescriptionSampleRule
Bulk add authentication devices - finished (bulk)Completion of an administrator bulk operation that adds authentication devices via the Entra admin center.NN
Download devices - finished (bulk)A bulk export of the tenant's device list to a CSV file finished.NN

Bulk add authentication devices - finished (bulk)

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceManagement

Description

Records completion of an administrator-initiated bulk operation that adds authentication devices in batch via the Microsoft Entra admin center (Microsoft Entra Management UX); the 'finished (bulk)' suffix marks the asynchronous batch job completing. The exact authentication-device type involved is not independently confirmed.

References #

Download devices - finished (bulk)

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceManagement

Description

A bulk operation that exports the tenant's device list to a CSV file from the Microsoft Entra admin center finished.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.