Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: Other
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Confirm | A user account was confirmed compromised, raising its risk level to high. | N | N |
| Confirm | A user account was confirmed safe, clearing its risk state and detections. | N | N |
| Confirm | Admin confirmed a risky user as compromised in Entra ID Protection, raising user risk to high. | N | N |
| Confirm | Admin confirmed a flagged user/sign-in as safe in ID Protection, clearing its risk and detections. | N | N |
| confirm | Admin confirmed a service principal (workload identity) as compromised in Entra ID Protection. | N | N |
| Create custom task extension | Creation of a Lifecycle Workflows custom task extension that calls an Azure Logic App as a workflow task. | N | N |
| Delete custom task extension | A Lifecycle Workflows custom task extension (Logic Apps callout) was deleted. | N | N |
| Dismiss | A risk in Microsoft Entra ID Protection was dismissed, moving the affected risk state to 'Dismissed'. | N | N |
| Dismiss | Risk on one or more risky service principals was dismissed, setting their risk level to none. | N | N |
| Dismiss | Risk on one or more risky users was dismissed, setting their risk level to none. | N | N |
| Generate one time password | Azure AD B2C generated a one-time password (OTP) code, typically for a user flow's email or phone verification step. | N | N |
| Update custom task extension | A Lifecycle Workflows custom task extension (Logic App callout) was updated. | N | N |
ConfirmAccountCompromised
#Description
A user account was confirmed as compromised, marking it as a true-positive risk and raising the user's risk level to high (consistent with the Microsoft Entra ID Protection "Confirm user compromised" action, which sets user risk to high and adds an "Admin confirmed user compromised" detection). A confirmed-compromise signal is high value for incident response and risk-based policy enforcement.
References #
ConfirmAccountSafe
#Description
A user account was confirmed as safe (a false-positive risk), which clears the user's risk and associated detections and returns the account to risk learning mode (consistent with the Microsoft Entra ID Protection "Confirm user safe" action). Because it clears risk state, misuse of this action can suppress a genuine compromise signal (defense evasion / risk suppression).
References #
ConfirmCompromised
#Description
Records an administrator confirming a risky user as compromised in Microsoft Entra ID Protection, which sets the user's risk level to high and adds the 'Admin confirmed user compromised' detection. The action is an incident-response signal and can trigger user-risk policies (such as forcing a high-risk user to reset their password).
References #
ConfirmSafe
#Description
Records an administrator confirming a flagged user (or sign-in) as safe in Microsoft Entra ID Protection, treating the detected risk as a false positive. For a confirmed-safe user, the doc states this removes the user's risk and existing detections and places the account in learning mode to relearn usage properties. A compromised privileged account could abuse this to suppress legitimate risk detections (defense evasion).
References #
confirmServicePrincipalCompromised
#Description
Records an administrator confirming a workload identity (service principal) as compromised in the Microsoft Entra ID Protection Risky workload identities report, marking its risk as a true positive. The action is an incident-response signal for an at-risk service principal and can drive workload-identity risk-based Conditional Access policies.
References #
Create custom task extension
#Description
A Lifecycle Workflows custom task extension was created, holding the configuration to call out to an Azure Logic App as a task within a joiner, mover, or leaver workflow. It introduces an external automation step into identity lifecycle processing.
References #
Delete custom task extension
#Description
A Lifecycle Workflows custom task extension was deleted. Custom task extensions call out to Azure Logic Apps as part of a workflow's tasks, for example during joiner, mover, or leaver automation.
References #
DismissRisk
#Description
A risk in Microsoft Entra ID Protection was dismissed (for example, a risky sign-in marked safe after review), moving the affected risk state to 'Dismissed'. Dismissing risk without investigation can hide a compromised identity from risk-based Conditional Access and remediation.
References #
DismissServicePrincipal
#Description
The risk on one or more risky service principals (workload identities) was dismissed, setting the targeted service principal's risk level to none. Dismissing workload-identity risk can mask a compromised application or service principal.
References #
DismissUser
#Description
The risk on one or more risky users was dismissed, setting the targeted user's risk level to none. Dismissing user risk can hide a compromised account from risk-based Conditional Access and remediation.
References #
Generate one time password
#Description
Azure AD B2C generated a one-time password (OTP) code, typically during a user flow's email or phone verification step, for the user to enter and have verified later. Elevated volumes can signal verification abuse or account enumeration.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.