detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrgPartnerConfigurationTemplate

OperationNameDescriptionSampleRule
Reset a multi tenant org partner configuration templateThe multitenant org partner configuration template was reset to default (decline all trust and auto user consent).NN
Update a multi tenant org partner configuration templateThe multitenant-org partner configuration template (trust + auto-redemption defaults for new partners) was updated.NN

Reset a multi tenant org partner configuration template

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgPartnerConfigurationTemplate

Description

Records that the multitenant organization cross-tenant access partner configuration template was reset to its default state, which declines all trust and automatic user consent settings (the resetToDefaultSettings operation). After the reset, partner cross-tenant trust and consent settings revert to default pass-through.

References #

Update a multi tenant org partner configuration template

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgPartnerConfigurationTemplate

Description

Records an update to the multitenant-organization partner configuration template, which preconfigures the cross-tenant access partner settings, namely trust of MFA and device claims and automatic user consent (invitation redemption), applied to partner tenants newly joining the multitenant organization. Changes that enable trust or automatic redemption broaden cross-tenant access for future partner tenants.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.