detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: OrganizationalUnitContainer

OperationNameDescriptionSampleRule
Create OrganizationalUnitCreation of an organizational unit container object in the directory.NN
Delete OrganizationalUnitDeletes an OrganizationalUnit container object in the directory (Core Directory).NN
Update OrganizationalUnitAn organizational unit container object in the Core Directory was updated.NN

Create OrganizationalUnit

#
Source
Microsoft Entra ID audit log
Audit Category
OrganizationalUnitContainer

Description

Records the creation of an organizational unit container object in the directory. Organizational units are directory containers used to group objects; creation is an infrequent administrative action in most Microsoft Entra tenants and is worth noting when unexpected.

References #

Delete OrganizationalUnit

#
Source
Microsoft Entra ID audit log
Audit Category
OrganizationalUnitContainer

Description

Records deletion of an OrganizationalUnit container object in the directory (Core Directory). Described conservatively from the operation name, category, and service; the precise object and its use were not confirmed against a Learn page.

References #

Update OrganizationalUnit

#
Source
Microsoft Entra ID audit log
Audit Category
OrganizationalUnitContainer

Description

An organizational unit container object in the Microsoft Entra Core Directory was updated. The directory feature backing this container object type was not confirmed against a Learn doc.

References #

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.