Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: KerberosDomain

OperationName	Description	Sample	Rule
Add kerberos domain	A Microsoft Entra Kerberos domain object was added to the directory (Entra Kerberos / cloud KDC).	N	N
Delete kerberos domain	Deletes the Entra Kerberos domain object used to issue Kerberos TGTs for an on-premises AD domain (hybrid FIDO2 / cloud Kerberos trust).	N	N
Restore kerberos domain	A Microsoft Entra Kerberos domain object was restored in the directory.	N	N
Update kerberos domain	Update to the Entra Kerberos domain object that lets Entra ID act as a cloud KDC for hybrid Kerberos sign-in.	N	N

Add kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

A Microsoft Entra Kerberos domain object was added to the directory. Microsoft Entra Kerberos makes Microsoft Entra ID act as a cloud Key Distribution Center (KDC) that issues Kerberos tickets, underpinning cloud Kerberos trust and Kerberos access to workloads such as Azure Files; adding this Kerberos infrastructure is a sensitive authentication-trust change.

References #

Delete kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records deletion of a Microsoft Entra Kerberos domain object, which lets Microsoft Entra ID act as a cloud KDC and issue Kerberos TGTs for an on-premises Active Directory domain (used by hybrid FIDO2 sign-in, cloud Kerberos trust, and Azure Files). Removing it can disrupt, or be abused to manipulate, hybrid Kerberos authentication.

References #

Restore kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records that a Kerberos domain object was restored in the directory. Microsoft Entra Kerberos uses a domain (trusted domain) object to issue Kerberos tickets for an on-premises Active Directory domain, so restoring it re-establishes that cloud-Kerberos trust configuration.

References #

Update kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records an update to the Microsoft Entra Kerberos domain object (the Microsoft Entra Kerberos server object that lets Entra ID act as a cloud Key Distribution Center (KDC) for hybrid Kerberos authentication). It underpins passwordless FIDO2 and Windows Hello for Business cloud-trust sign-in to on-premises resources, so changes touch Kerberos trust and key material.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.