Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: ObjectManagement

OperationNameDescriptionSampleRule
Offboarding Process StartedThe Global Secure Access offboarding (removal/disable) process was started for the tenant.NN
Onboarding Process StartedThe Global Secure Access onboarding process was started for the tenant (initial service activation).NN
Update Adaptive Access PolicyModification of a Global Secure Access adaptive access policy (Conditional Access based network/session controls).NN
Update Enriched Audit Logs SettingsGlobal Secure Access enriched Microsoft 365 logs settings were updated.NN
Update Forwarding Options PolicyA tenant-level Global Secure Access forwarding option (DNS-skip routing Microsoft 365 traffic direct to Azure Front Door) was updated.NN

Offboarding Process Started

#
Source
Microsoft Entra ID audit log
Audit Category
ObjectManagement

Description

Records that the Global Secure Access offboarding process was started for the tenant, beginning removal or disablement of the Global Secure Access service. Because it initiates teardown of a network-security service, an unexpected occurrence may warrant review as potential defense evasion.

References #

Onboarding Process Started

#
Source
Microsoft Entra ID audit log
Audit Category
ObjectManagement

Description

Records that Global Secure Access onboarding (initial service activation) began for the tenant. Global Secure Access is Microsoft's Security Service Edge (SSE) solution; activating it lets tenant network traffic be routed through the Internet Access, Private Access, and Microsoft traffic forwarding profiles, making it a notable tenant-configuration change.

References #

Update Adaptive Access Policy

#
Source
Microsoft Entra ID audit log
Audit Category
ObjectManagement

Description

Records modification of an adaptive access policy in Microsoft Entra Global Secure Access, which applies Conditional Access based controls (such as compliant-network checks and adaptive session controls) to traffic routed through Global Secure Access. Weakening these controls is relevant to defense evasion.

References #

Update Enriched Audit Logs Settings

#
Source
Microsoft Entra ID audit log
Audit Category
ObjectManagement

Description

The Global Secure Access enriched Microsoft 365 logs configuration was updated, controlling how Microsoft 365 audit events are augmented with Global Secure Access network context such as source IP and device.

References #

Update Forwarding Options Policy

#
Source
Microsoft Entra ID audit log
Audit Category
ObjectManagement

Description

A tenant-level Global Secure Access traffic-forwarding option was updated. Forwarding options control the DNS resolution strategy for tunneled traffic: they determine whether DNS lookup is skipped at the client so that Microsoft 365 traffic is forwarded directly to Azure Front Door using the client-resolved destination IP, or whether DNS resolution is instead performed at the edge, so the record reflects a change to how Microsoft 365 traffic is routed and optimized.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.