detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: DeviceTemplate

OperationNameDescriptionSampleRule
Add device from DeviceTemplateA device object was created from a device template (createDeviceFromTemplate).NN
Add DeviceTemplateA new device template (deviceTemplate) was created in the directory.NN
Add owner to DeviceTemplateAn owner was added to a device template, granting full control over the template and its device instances.NN
Delete DeviceTemplateDeletion of a device template (deviceTemplates Graph API directory object holding device properties such as manufacturer, model, OS).NN

Add device from DeviceTemplate

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceTemplate

Description

A new device object was created from a device template, stamping the template's common property values onto the device (the Microsoft Graph deviceTemplate createDeviceFromTemplate action). Device templates onboard sets of similar devices (for example, IoT or external devices) into the directory, so new device-identity creation here can warrant review.

References #

Add DeviceTemplate

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceTemplate

Description

A new device template was created in the directory. A deviceTemplate defines property values common to a set of device objects and is used to identify and manage a group of devices with similar characteristics (for example, IoT devices).

References #

Add owner to DeviceTemplate

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceTemplate

Description

Records the addition of an owner (a user or service principal) to a device template. Per the Microsoft Graph beta add-owner reference, a device template owner is granted permissions to create, update, enable, disable, and delete the device instances created from that template and to add or remove other owners, without requiring additional administrator roles.

References #

Delete DeviceTemplate

#
Source
Microsoft Entra ID audit log
Audit Category
DeviceTemplate

Description

A device template was deleted. Device templates are directory objects, managed through the deviceTemplates Microsoft Graph API, that hold properties (such as manufacturer, model, and operating system) describing devices registered in the directory.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.