detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrgIdentitySyncPolicyUpdate

OperationNameDescriptionSampleRule
Reset a multi tenant org identity sync policy templateThe multitenant org identity synchronization policy template was reset to its default state (decline inbound sync).NN
Update a multi tenant org identity sync policy templateThe multitenant-org identity sync policy template (inbound user sync default for new partners) was updated.NN

Reset a multi tenant org identity sync policy template

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgIdentitySyncPolicyUpdate

Description

Records that the multitenant organization identity synchronization policy template was reset to its default state, which declines inbound user synchronization (the resetToDefaultSettings operation). After the reset, partner identity-synchronization policies are no longer amended by the template.

References #

Update a multi tenant org identity sync policy template

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgIdentitySyncPolicyUpdate

Description

Records an update to the multitenant-organization identity synchronization policy template, which preconfigures whether inbound user synchronization is allowed (the userSyncInbound setting) for partner tenants that newly join the multitenant organization. Enabling inbound sync in the template can lead to B2B accounts being provisioned into the tenant from partner tenants, so the change is relevant to cross-tenant provisioning exposure.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.