detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: IdentityProtection

OperationNameDescriptionSampleRule
Update IdentityProtectionPolicyConfiguration change to an Entra ID Protection risk policy (sign-in or user risk).NN
Update NotificationSettingsNotification settings for the hybrid authentication subsystem were updated.NN

Update IdentityProtectionPolicy

#
Source
Microsoft Entra ID audit log
Audit Category
IdentityProtection

Description

Records a configuration change to a Microsoft Entra ID Protection risk policy (sign-in risk or user risk) that governs automated responses such as requiring MFA or blocking access. Weakening or disabling these policies reduces protection against risky sign-ins and can aid defense evasion.

References #

Update NotificationSettings

#
Source
Microsoft Entra ID audit log
Audit Category
IdentityProtection

Description

Notification settings within the hybrid authentication subsystem were updated, for example the email-alert configuration that notifies administrators when the on-premises hybrid identity infrastructure is unhealthy. The exact feature behind this audit operation was not confirmed against a single Learn doc.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.