Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: KeyManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Read Bit | A BitLocker recovery key was read from the directory. | N | Y |
| Add Bit | A device's BitLocker recovery key was escrowed (backed up) to Microsoft Entra ID. | N | N |
| Delete Bit | A stored BitLocker recovery key was deleted from the directory. | N | N |
Read BitLocker key
#Description
A BitLocker recovery key was read from the directory.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
Category | 1 detection rule | Sigma |
OperationName | 1 detection rule | Sigma |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sigma #
T1078, T1078.004
References #
Add BitLocker key
#Description
A device's BitLocker recovery key was stored (escrowed) in Microsoft Entra ID. Recovery keys are stored in the directory for encrypted Windows devices that escrow their keys to Microsoft Entra ID and can later be read by authorized administrators; both the backup and any key read are audited under the KeyManagement category.
References #
Delete BitLocker key
#Description
Records the deletion of a stored BitLocker recovery key (bitlockerRecoveryKey) held in the directory and associated with a device. Because the recovery key is what restores access to a BitLocker-protected drive, its removal can impede data recovery, so deletions warrant scrutiny as potential impact or anti-recovery activity.
References #
Computed Fields in AuditLogs #
Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.
Initiating*values come fromInitiatedBy:InitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, orInitiatedBy.user.id; application actors useInitiatedBy.app.displayNameorInitiatedBy.app.appId.- Change details come from
TargetResources[].modifiedProperties. ExpandTargetResourcesbefore usingdisplayName,oldValue, ornewValue.
Sources: the AuditLogs table reference and Graph directoryAudit resource.