Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: KerberosDomain

OperationName	Description	Sample	Rule
Add kerberos domain	A Microsoft Entra Kerberos domain object was added to the directory (Entra Kerberos / cloud KDC).	N	N
Delete kerberos domain	Deletes the Entra Kerberos domain object used to issue Kerberos TGTs for an on-premises AD domain (hybrid FIDO2 / cloud Kerberos trust).	N	N
Restore kerberos domain	A Microsoft Entra Kerberos domain object was restored in the directory.	N	N
Update kerberos domain	Update to the Entra Kerberos domain object that lets Entra ID act as a cloud KDC for hybrid Kerberos sign-in.	N	N

Add kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

A Microsoft Entra Kerberos domain object was added to the directory. Microsoft Entra Kerberos makes Microsoft Entra ID act as a cloud Key Distribution Center (KDC) that issues Kerberos tickets, underpinning cloud Kerberos trust and Kerberos access to workloads such as Azure Files; adding this Kerberos infrastructure is a sensitive authentication-trust change.

References #

Delete kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records deletion of a Microsoft Entra Kerberos domain object, which lets Microsoft Entra ID act as a cloud KDC and issue Kerberos TGTs for an on-premises Active Directory domain (used by hybrid FIDO2 sign-in, cloud Kerberos trust, and Azure Files). Removing it can disrupt, or be abused to manipulate, hybrid Kerberos authentication.

References #

Restore kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records that a Kerberos domain object was restored in the directory. Microsoft Entra Kerberos uses a domain (trusted domain) object to issue Kerberos tickets for an on-premises Active Directory domain, so restoring it re-establishes that cloud-Kerberos trust configuration.

References #

Update kerberos domain

Source: Microsoft Entra ID audit log
Audit Category: KerberosDomain

Description

Records an update to the Microsoft Entra Kerberos domain object (the Microsoft Entra Kerberos server object that lets Entra ID act as a cloud Key Distribution Center (KDC) for hybrid Kerberos authentication). It underpins passwordless FIDO2 and Windows Hello for Business cloud-trust sign-in to on-premises resources, so changes touch Kerberos trust and key material.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.