Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: KeyManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Read Bit | A BitLocker recovery key was read from the directory. | N | Y |
| Add Bit | A device's BitLocker recovery key was escrowed (backed up) to Microsoft Entra ID. | N | N |
| Delete Bit | A stored BitLocker recovery key was deleted from the directory. | N | N |
Read BitLocker key
#Description
A BitLocker recovery key was read from the directory.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1078, T1078.004
References #
Add BitLocker key
#Description
A device's BitLocker recovery key was stored (escrowed) in Microsoft Entra ID. Recovery keys are stored in the directory for encrypted Windows devices that escrow their keys to Microsoft Entra ID and can later be read by authorized administrators; both the backup and any key read are audited under the KeyManagement category.
References #
Delete BitLocker key
#Description
Records the deletion of a stored BitLocker recovery key (bitlockerRecoveryKey) held in the directory and associated with a device. Because the recovery key is what restores access to a BitLocker-protected drive, its removal can impede data recovery, so deletions warrant scrutiny as potential impact or anti-recovery activity.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.