Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: MicrosoftSupportAccessManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Access approved | An admin approved a Microsoft Support access request, granting Microsoft Support read-only access to tenant identity diagnostic data. | N | N |
| Access removed | Access previously granted to Microsoft Support for the tenant was removed (revoked or expired). | N | N |
| Request canceled | A Microsoft Support access request (time-limited Microsoft Support access to identity diagnostic data) was canceled. | N | N |
| Request created | A request was created in the Microsoft Support access management workflow (governs Microsoft Support access to the tenant). | N | N |
| Request rejected | A request in the Microsoft Support access management workflow was rejected (counterpart to the request-created entry). | N | N |
Access approved
#Description
An administrator approved a Microsoft Support access request, granting Microsoft Support time-limited, read-only access to the tenant's identity diagnostic data for a support case. Worth reviewing to confirm that Microsoft support access grants are expected and tied to a known case.
References #
Access removed
#Description
Records that access previously granted to Microsoft Support for the tenant was removed (revoked or expired). The entry falls under the Microsoft Support access management feature, which governs Microsoft Support engineers' access to the tenant; the close of such an access window, and any unexpected grant/removal cycle, can be relevant to monitoring third-party access to directory data.
References #
Request canceled
#Description
A Microsoft Support access request was canceled. Through Microsoft Support access requests, an administrator grants Microsoft Support time-limited, read-only access to the tenant's identity diagnostic data for a support case; this record reflects cancellation of such a pending or active request before it runs its course.
References #
Request created
#Description
Records the creation of a request within Microsoft Entra's Microsoft Support access management workflow, the category that governs Microsoft Support's access to the tenant's directory. These entries mark when such a support-access request is initiated and are relevant to tracking external Microsoft access to directory data.
References #
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.