detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrgTenant

OperationNameDescriptionSampleRule
Add MultiTenantOrg tenantAn owner tenant added a tenant (pending join) to the multitenant organization (MTO).NN
Delete MultiTenantOrg tenantRemoves a member tenant from the Microsoft Entra multitenant organization (MTO).NN
Hard Delete MultiTenantOrg tenantPermanent removal of a member tenant from the multitenant organization.NN
Tenant joining MultiTenantOrg tenantA tenant joined a Microsoft Entra multitenant organization (invite-and-accept tenant grouping).NN
Update MultiTenantOrg tenantA tenant within the multitenant organization (MTO) boundary was updated.NN

Add MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records the owner tenant adding another Microsoft Entra tenant to the multitenant organization (MTO), placing that tenant in a pending state until it joins. The MTO defines a boundary around the tenants an organization owns and governs cross-tenant access settings (B2B collaboration and cross-tenant synchronization) between member tenants, so expanding membership broadens the cross-tenant collaboration surface.

References #

Delete MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records removal of a member tenant from the Microsoft Entra multitenant organization (MTO), the tenant group that defines the boundary of tenants an organization owns for cross-tenant collaboration. Changing MTO membership alters the cross-tenant collaboration topology and merits review.

References #

Hard Delete MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records the permanent (hard) removal of a member tenant from a multitenant organization in Microsoft Entra ID, changing which tenants fall within the organization's multitenant collaboration boundary.

References #

Tenant joining MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records a tenant joining a Microsoft Entra multitenant organization, the boundary that groups the Entra tenants an organization owns, established through an invite-and-accept flow between tenant administrators. Joining adds the tenant to the multitenant organization configuration.

References #

Update MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

A tenant belonging to the multitenant organization (MTO) was updated, changing that tenant's configuration or membership within the organization's MTO boundary in the Core Directory. MTO changes can broaden cross-tenant trust and automated user provisioning, so they warrant review.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.