Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: ObjectManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Offboarding Process Started | The Global Secure Access offboarding (removal/disable) process was started for the tenant. | N | N |
| Onboarding Process Started | The Global Secure Access onboarding process was started for the tenant (initial service activation). | N | N |
| Update Adaptive Access Policy | Modification of a Global Secure Access adaptive access policy (Conditional Access based network/session controls). | N | N |
| Update Enriched Audit Logs Settings | Global Secure Access enriched Microsoft 365 logs settings were updated. | N | N |
| Update Forwarding Options Policy | A tenant-level Global Secure Access forwarding option (DNS-skip routing Microsoft 365 traffic direct to Azure Front Door) was updated. | N | N |
Offboarding Process Started
#Description
Records that the Global Secure Access offboarding process was started for the tenant, beginning removal or disablement of the Global Secure Access service. Because it initiates teardown of a network-security service, an unexpected occurrence may warrant review as potential defense evasion.
References #
Onboarding Process Started
#Description
Records that Global Secure Access onboarding (initial service activation) began for the tenant. Global Secure Access is Microsoft's Security Service Edge (SSE) solution; activating it lets tenant network traffic be routed through the Internet Access, Private Access, and Microsoft traffic forwarding profiles, making it a notable tenant-configuration change.
References #
Update Adaptive Access Policy
#Description
Records modification of an adaptive access policy in Microsoft Entra Global Secure Access, which applies Conditional Access based controls (such as compliant-network checks and adaptive session controls) to traffic routed through Global Secure Access. Weakening these controls is relevant to defense evasion.
References #
Update Enriched Audit Logs Settings
#Description
The Global Secure Access enriched Microsoft 365 logs configuration was updated, controlling how Microsoft 365 audit events are augmented with Global Secure Access network context such as source IP and device.
References #
Update Forwarding Options Policy
#Description
A tenant-level Global Secure Access traffic-forwarding option was updated. Forwarding options control the DNS resolution strategy for tunneled traffic: they determine whether DNS lookup is skipped at the client so that Microsoft 365 traffic is forwarded directly to Azure Front Door using the client-resolved destination IP, or whether DNS resolution is instead performed at the edge, so the record reflects a change to how Microsoft 365 traffic is routed and optimized.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.