detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: PendingExternalUserProfile

OperationNameDescriptionSampleRule
Create PendingExternalUserProfileCreation of a pending external user profile pre-staging an external user's attributes (can surface in Teams search) before they consent.NN
Delete PendingExternalUserProfileDeletion of a pending (pre-provisioned, not-yet-redeemed) external B2B user profile object.NN
Hard Delete PendingExternalUserProfilePermanent deletion of a pending external user profile (external user not yet consented).NN

Create PendingExternalUserProfile

#
Source
Microsoft Entra ID audit log
Audit Category
PendingExternalUserProfile

Description

Records the creation of a pending external user profile, a directory placeholder that pre-stages an external user's profile attributes (display name, company name, job title, department, phone number) in the tenant before that external user has consented to share their data. These profiles can surface in Microsoft Teams search, supporting external-collaboration scenarios, so pre-provisioning external identities is worth tracking for unexpected external-access staging.

References #

Delete PendingExternalUserProfile

#
Source
Microsoft Entra ID audit log
Audit Category
PendingExternalUserProfile

Description

Records the deletion of a pending external user profile, the pre-provisioned placeholder object created in the directory for an external (B2B) identity that has not yet redeemed an invitation or been added as a full guest. Removal of a pre-staged external identity may precede or accompany changes to external collaboration access.

References #

Hard Delete PendingExternalUserProfile

#
Source
Microsoft Entra ID audit log
Audit Category
PendingExternalUserProfile

Description

Records the permanent (hard) deletion of a pendingExternalUserProfile object, which represents an external user in the Microsoft Entra tenant who has not yet consented to share their data with the tenant. The resource is defined only on the Microsoft Graph beta endpoint.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.