Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: DeviceManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Bulk add authentication devices - finished (bulk) | Completion of an administrator bulk operation that adds authentication devices via the Entra admin center. | N | N |
| Download devices - finished (bulk) | A bulk export of the tenant's device list to a CSV file finished. | N | N |
Bulk add authentication devices - finished (bulk)
#Description
Records completion of an administrator-initiated bulk operation that adds authentication devices in batch via the Microsoft Entra admin center (Microsoft Entra Management UX); the 'finished (bulk)' suffix marks the asynchronous batch job completing. The exact authentication-device type involved is not independently confirmed.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.