detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: MultiTenantOrgTenant

OperationNameDescriptionSampleRule
Add MultiTenantOrg tenantAn owner tenant added a tenant (pending join) to the multitenant organization (MTO).NN
Delete MultiTenantOrg tenantRemoves a member tenant from the Microsoft Entra multitenant organization (MTO).NN
Hard Delete MultiTenantOrg tenantPermanent removal of a member tenant from the multitenant organization.NN
Tenant joining MultiTenantOrg tenantA tenant joined a Microsoft Entra multitenant organization (invite-and-accept tenant grouping).NN
Update MultiTenantOrg tenantA tenant within the multitenant organization (MTO) boundary was updated.NN

Add MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records the owner tenant adding another Microsoft Entra tenant to the multitenant organization (MTO), placing that tenant in a pending state until it joins. The MTO defines a boundary around the tenants an organization owns and governs cross-tenant access settings (B2B collaboration and cross-tenant synchronization) between member tenants, so expanding membership broadens the cross-tenant collaboration surface.

References #

Delete MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records removal of a member tenant from the Microsoft Entra multitenant organization (MTO), the tenant group that defines the boundary of tenants an organization owns for cross-tenant collaboration. Changing MTO membership alters the cross-tenant collaboration topology and merits review.

References #

Hard Delete MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records the permanent (hard) removal of a member tenant from a multitenant organization in Microsoft Entra ID, changing which tenants fall within the organization's multitenant collaboration boundary.

References #

Tenant joining MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

Records a tenant joining a Microsoft Entra multitenant organization, the boundary that groups the Entra tenants an organization owns, established through an invite-and-accept flow between tenant administrators. Joining adds the tenant to the multitenant organization configuration.

References #

Update MultiTenantOrg tenant

#
Source
Microsoft Entra ID audit log
Audit Category
MultiTenantOrgTenant

Description

A tenant belonging to the multitenant organization (MTO) was updated, changing that tenant's configuration or membership within the organization's MTO boundary in the Core Directory. MTO changes can broaden cross-tenant trust and automated user provisioning, so they warrant review.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

  • Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
  • Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.