Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrgIdentitySyncPolicyUpdate

OperationName	Description	Sample	Rule
Reset a multi tenant org identity sync policy template	The multitenant org identity synchronization policy template was reset to its default state (decline inbound sync).	N	N
Update a multi tenant org identity sync policy template	The multitenant-org identity sync policy template (inbound user sync default for new partners) was updated.	N	N

Reset a multi tenant org identity sync policy template

Source: Microsoft Entra ID audit log
Audit Category: MultiTenantOrgIdentitySyncPolicyUpdate

Description

Records that the multitenant organization identity synchronization policy template was reset to its default state, which declines inbound user synchronization (the resetToDefaultSettings operation). After the reset, partner identity-synchronization policies are no longer amended by the template.

References #

Update a multi tenant org identity sync policy template

Source: Microsoft Entra ID audit log
Audit Category: MultiTenantOrgIdentitySyncPolicyUpdate

Description

Records an update to the multitenant-organization identity synchronization policy template, which preconfigures whether inbound user synchronization is allowed (the userSyncInbound setting) for partner tenants that newly join the multitenant organization. Enabling inbound sync in the template can lead to B2B accounts being provisioned into the tenant from partner tenants, so the change is relevant to cross-tenant provisioning exposure.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.