detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrg

OperationNameDescriptionSampleRule
Create a MultiTenantOrgA multitenant organization was created in Microsoft Entra ID.NN
Hard Delete MultiTenantOrgPermanent deletion of the tenant's multitenant organization configuration.NN
Update a MultiTenantOrgThe multitenant organization configuration (member tenants / properties) was updated.NN

Create a MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records the creation of a multitenant organization in Microsoft Entra ID, the construct that defines a boundary around the tenants an organization owns and groups them for collaboration and cross-tenant synchronization. Establishing a new multitenant organization expands cross-tenant relationships and is relevant to monitoring for unexpected tenant trust.

References #

Hard Delete MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records the permanent (hard) deletion of the tenant's multitenant organization, the Microsoft Entra construct that defines a boundary around the tenants owned by one organization to enable cross-tenant collaboration.

References #

Update a MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records an update to the multitenant organization configuration in the tenant: the object that groups multiple Microsoft Entra tenants so they can collaborate as a single organization, including its properties and member-tenant relationships. The entry reflects a change to multitenant-organization membership or configuration.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.