Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MicrosoftSupportAccessManagement

OperationName	Description	Sample	Rule
Access approved	An admin approved a Microsoft Support access request, granting Microsoft Support read-only access to tenant identity diagnostic data.	N	N
Access removed	Access previously granted to Microsoft Support for the tenant was removed (revoked or expired).	N	N
Request canceled	A Microsoft Support access request (time-limited Microsoft Support access to identity diagnostic data) was canceled.	N	N
Request created	A request was created in the Microsoft Support access management workflow (governs Microsoft Support access to the tenant).	N	N
Request rejected	A request in the Microsoft Support access management workflow was rejected (counterpart to the request-created entry).	N	N

Access approved

Source: Microsoft Entra ID audit log
Audit Category: MicrosoftSupportAccessManagement

Description

An administrator approved a Microsoft Support access request, granting Microsoft Support time-limited, read-only access to the tenant's identity diagnostic data for a support case. Worth reviewing to confirm that Microsoft support access grants are expected and tied to a known case.

Access removed

Source: Microsoft Entra ID audit log
Audit Category: MicrosoftSupportAccessManagement

Description

Records that access previously granted to Microsoft Support for the tenant was removed (revoked or expired). The entry falls under the Microsoft Support access management feature, which governs Microsoft Support engineers' access to the tenant; the close of such an access window, and any unexpected grant/removal cycle, can be relevant to monitoring third-party access to directory data.

Request canceled

Source: Microsoft Entra ID audit log
Audit Category: MicrosoftSupportAccessManagement

Description

A Microsoft Support access request was canceled. Through Microsoft Support access requests, an administrator grants Microsoft Support time-limited, read-only access to the tenant's identity diagnostic data for a support case; this record reflects cancellation of such a pending or active request before it runs its course.

Request created

Source: Microsoft Entra ID audit log
Audit Category: MicrosoftSupportAccessManagement

Description

Records the creation of a request within Microsoft Entra's Microsoft Support access management workflow, the category that governs Microsoft Support's access to the tenant's directory. These entries mark when such a support-access request is initiated and are relevant to tracking external Microsoft access to directory data.

Request rejected

Source: Microsoft Entra ID audit log
Audit Category: MicrosoftSupportAccessManagement

Description

Records that a request in Microsoft Entra's Microsoft Support access management workflow was rejected. It is the counterpart to the request-created entry in that workflow, which governs Microsoft Support's access to the tenant's directory data.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.