Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: OrganizationalUnitContainer
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Create Organizational | Creation of an organizational unit container object in the directory. | N | N |
| Delete Organizational | Deletes an OrganizationalUnit container object in the directory (Core Directory). | N | N |
| Update Organizational | An organizational unit container object in the Core Directory was updated. | N | N |
Create OrganizationalUnit
#Description
Records the creation of an organizational unit container object in the directory. Organizational units are directory containers used to group objects; creation is an infrequent administrative action in most Microsoft Entra tenants and is worth noting when unexpected.
Delete OrganizationalUnit
#Description
Records deletion of an OrganizationalUnit container object in the directory (Core Directory). Described conservatively from the operation name, category, and service; the precise object and its use were not confirmed against a Learn page.
Update OrganizationalUnit
#Description
An organizational unit container object in the Microsoft Entra Core Directory was updated. The directory feature backing this container object type was not confirmed against a Learn doc.
References #
Computed Fields in AuditLogs #
Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.
Initiating*values come fromInitiatedBy:InitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, orInitiatedBy.user.id; application actors useInitiatedBy.app.displayNameorInitiatedBy.app.appId.- Change details come from
TargetResources[].modifiedProperties. ExpandTargetResourcesbefore usingdisplayName,oldValue, ornewValue.
Sources: the AuditLogs table reference and Graph directoryAudit resource.