detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrg

OperationNameDescriptionSampleRule
Create a MultiTenantOrgA multitenant organization was created in Microsoft Entra ID.NN
Hard Delete MultiTenantOrgPermanent deletion of the tenant's multitenant organization configuration.NN
Update a MultiTenantOrgThe multitenant organization configuration (member tenants / properties) was updated.NN

Create a MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records the creation of a multitenant organization in Microsoft Entra ID, the construct that defines a boundary around the tenants an organization owns and groups them for collaboration and cross-tenant synchronization. Establishing a new multitenant organization expands cross-tenant relationships and is relevant to monitoring for unexpected tenant trust.

References #

Hard Delete MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records the permanent (hard) deletion of the tenant's multitenant organization, the Microsoft Entra construct that defines a boundary around the tenants owned by one organization to enable cross-tenant collaboration.

References #

Update a MultiTenantOrg

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrg

Description

Records an update to the multitenant organization configuration in the tenant: the object that groups multiple Microsoft Entra tenants so they can collaborate as a single organization, including its properties and member-tenant relationships. The entry reflects a change to multitenant-organization membership or configuration.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.