Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Label

OperationName	Description	Sample	Rule
Add label	A sensitivity label was applied to a Microsoft Entra (Microsoft 365) group.	N	N
Delete label	Deletes a sensitivity/classification label synchronized to Entra ID for Microsoft 365 groups and sites.	N	N
Update label	Update to a label definition stored in the Microsoft Entra (Core Directory).	N	N

Add label

Source: Microsoft Entra ID audit log
Audit Category: Label

Description

A sensitivity label was applied to a Microsoft Entra group. In Entra ID, published Microsoft Purview sensitivity labels can be applied to Microsoft 365 groups, where they enforce the group's connected-workspace settings such as privacy and guest access.

References #

Delete label

Source: Microsoft Entra ID audit log
Audit Category: Label

Description

Records deletion of a sensitivity (classification) label from the directory, the labels synchronized to Microsoft Entra ID and applied to Microsoft 365 groups, Teams, and SharePoint sites. Removing a label can relax container-level protections on those workspaces.

References #

Update label

Source: Microsoft Entra ID audit log
Audit Category: Label

Description

Records an update to a label definition stored in the Microsoft Entra Core Directory. The specific label type cannot be determined from the operation name, category, and service alone.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.