Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: PermissionGrantPolicy

OperationName	Description	Sample	Rule
Add permission grant policy	A permission grant policy defining app-consent conditions was created.	Y	N
Delete permission grant policy	Deletion of an app consent (permission grant) policy governing when apps/users may be granted delegated permissions.	Y	N
Update permission grant policy	An app consent (permission grant) policy governing permission grants to apps was modified.	N	N

Add permission grant policy

Source: Microsoft Entra ID audit log
Audit Category: PermissionGrantPolicy

Description

Records the creation of a permission grant policy, which defines the include and exclude condition sets under which application consent (delegated permission grants) may be granted. Overly permissive custom permission grant policies can broaden user consent and enable illicit consent-grant attacks.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:20:53.8160997Z",
  "ActivityDisplayName": "Add permission grant policy",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "PermissionGrantPolicy",
  "CorrelationId": "8dbf64e0-1cbc-40d6-a0e6-e4cc23e33ddc",
  "DurationMs": "0",
  "Id": "Directory_8dbf64e0-1cbc-40d6-a0e6-e4cc23e33ddc_M38SZ_10472378",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add permission grant policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "82aca392-bf62-49e7-a864-e071ba0e544d",
      "displayName": null,
      "type": "Other",
      "modifiedProperties": [
        {
          "displayName": "PermissionGrantPolicy",
          "oldValue": null,
          "newValue": {
            "EncodingVersion": 2,
            "Id": "dwharn-pgp-cf516524",
            "Includes": [],
            "Excludes": [],
            "DisplayName": "dw-harness-pgp-cf516524",
            "Description": "harness",
            "IncludeAllPreApprovedApplications": false,
            "ConsentResourceScopeType": "tenant"
          }
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Delete permission grant policy

Source: Microsoft Entra ID audit log
Audit Category: PermissionGrantPolicy

Description

Records the deletion of a permission grant policy (app consent policy), which defines the conditions under which applications may be granted delegated permissions or users may consent to apps. Deleting or weakening these policies can broaden the scope for illicit application consent.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:20:54.9877418Z",
  "ActivityDisplayName": "Delete permission grant policy",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "PermissionGrantPolicy",
  "CorrelationId": "e08342ba-f0b1-443f-89b0-db0a02627e81",
  "DurationMs": "0",
  "Id": "Directory_e08342ba-f0b1-443f-89b0-db0a02627e81_MW2BI_10465729",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Delete permission grant policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "82aca392-bf62-49e7-a864-e071ba0e544d",
      "displayName": null,
      "type": "Other",
      "modifiedProperties": [
        {
          "displayName": "PermissionGrantPolicy",
          "oldValue": {
            "EncodingVersion": 2,
            "Id": "dwharn-pgp-cf516524",
            "Includes": [],
            "Excludes": [],
            "DisplayName": "dw-harness-pgp-cf516524",
            "Description": "harness",
            "IncludeAllPreApprovedApplications": false,
            "ConsentResourceScopeType": "tenant"
          },
          "newValue": null
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Update permission grant policy

Source: Microsoft Entra ID audit log
Audit Category: PermissionGrantPolicy

Description

An app consent (permission grant) policy was modified. These policies define the conditions under which permissions may be granted to applications, so loosening one can enable illicit-consent or OAuth application abuse.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.