Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: Policy

OperationName	Description	Sample	Rule
Add conditional access policy	A Conditional Access policy was created.	Y	Y
Add named location	A named location (IP range) was created for Conditional Access.	Y	Y
Authentication Methods Policy Update	The tenant authentication-methods policy was changed.	N	Y
Delete conditional access policy	A Conditional Access policy was deleted.	Y	Y
Set device registration policies	Device registration policies were changed.	N	Y
Update conditional access policy	A Conditional Access policy was modified (tampering can weaken enforcement).	N	Y
Update named location	A named location was modified.	N	Y
Update User Risk and MFA Registration Policy	The user-risk or MFA-registration policy was changed.	N	Y
Accept Terms Of Use	A user accepted a Microsoft Entra Terms of Use agreement (commonly enforced via Conditional Access).	N	N
Access review ended	An access review instance reached the end of its review period and closed.	N	N
Add AuthenticationContextClassReference	A Conditional Access authentication context definition (C1-C99) was created.	N	N
Add blocked user	A user was added to an Entra block list, likely the legacy (now-retired) MFA Block/unblock users list.	N	N
Add bypass user	A user was added to a bypass list, most plausibly an MFA/authentication bypass exemption (exact policy unconfirmed).	N	N
Add owner to policy	An owner was added to a directory policy object.	N	N
Add policy	A directory policy object was created.	Y	N
Apply decision	An access-review decision was applied to a reviewed user, enacting the approve/deny outcome.	N	N
Approve decision	A reviewer approved an individual access-review decision, continuing the reviewed user's access.	N	N
Bulk Approve decisions	A reviewer bulk-approved multiple access review decisions.	N	N
Bulk Deny decisions	A reviewer applied Deny decisions to multiple users at once in an access review.	N	N
Bulk mark decisions as don't know	A reviewer applied the 'Don't know' decision to multiple users at once in an access review.	N	N
Bulk Reset decisions	All reviewer decisions on an access review were reset, marking every user as not reviewed.	N	N
Cancel request	A pending request handled by the Access Reviews service was cancelled.	N	N
Clear block on user	A block previously placed on a user account was cleared, reversing the earlier block.	N	N
Create access review	An access review was created in Microsoft Entra ID Governance.	N	N
Create request	Creation of an access review request configuring a new review of access to groups, apps, or roles.	N	N
Create Terms Of Use	Creation of a Microsoft Entra Terms of Use policy (enforced via Conditional Access).	N	N
Decline Terms Of Use	A user declined a Microsoft Entra Terms of Use policy.	N	N
Delete access review	An access review (recurring access recertification) was deleted.	N	N
Delete approvals	An approvals object associated with a Microsoft Entra access review was deleted.	N	N
Delete AuthenticationContextClassReference	A Conditional Access authentication context class reference was deleted.	N	N
Delete Consent	A recorded user consent (acceptance) for a Terms of Use agreement was deleted.	N	N
Delete named location	Deletes a Conditional Access named location (IP ranges or countries), which can weaken location-based CA policies.	Y	N
Delete policy	Deletion of a generic Microsoft Entra directory policy object (tenant-level policy resource).	Y	N
Delete Terms Of Use	Deletes a Microsoft Entra terms of use agreement used as a Conditional Access gate.	N	N
Deny decision	A reviewer denied a single access-review decision, marking the user for access removal.	N	N
Don't know decision	A reviewer recorded a 'Don't know' decision in an access review; the user keeps access and the choice is logged.	N	N
Edit Terms Of Use	An existing Terms of Use agreement was edited (name, display name, document version, or language).	N	N
Hard Delete policy	Permanent deletion of a directory policy object (e.g. token-lifetime, claims-mapping).	N	N
Publish Terms Of Use	A Microsoft Entra terms of use agreement was published for enforcement via Conditional Access.	N	N
Remove bypassed user	Removes a user from a multifactor authentication (MFA) bypass list, ending that user's MFA exemption.	N	N
Remove owner from policy	An owner was removed from a Microsoft Entra policy object, changing who can manage that policy.	N	N
Remove policy credentials	Credentials associated with a Microsoft Entra policy object were removed.	N	N
Request expired	An access review request or instance expired at its scheduled end without a completed decision.	N	N
Reset decision	A previously recorded access review decision was reset, returning the user's entry to an undecided state.	N	N
Restore policy	A directory policy object was restored in the Core Directory service.	N	N
Update access review	Modification of an access review (recurring or one-time review of access to groups, apps, or roles).	N	N
Update AuthenticationContextClassReference	Records a change to a Conditional Access authentication context class reference (custom value enforcing CA requirements).	N	N
Update continuous access evaluation	Change to the continuous access evaluation (CAE) setting in a Conditional Access policy.	N	N
Update partner directory settings	Settings governing access reviews of a partner (external) directory were updated.	N	N
Update policy	A directory policy object was updated in Core Directory.	Y	N
Update request	An access review request was updated.	N	N
Update security defaults	The tenant-wide security defaults baseline was enabled or disabled.	N	N
Update Sign-In Risk Policy	The Microsoft Entra ID Protection sign-in risk policy was updated.	N	N

Add conditional access policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A Conditional Access policy was created.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-03T03:01:45.5370155Z",
  "ActivityDisplayName": "Add conditional access policy",
  "AdditionalDetails": [
    {
      "key": "Category",
      "value": "Conditional Access"
    }
  ],
  "Category": "Policy",
  "CorrelationId": "9e0f4b19-6ec1-4d4f-8020-c8793a30c7e4",
  "DurationMs": "0",
  "Id": "IPCGraph_9e0f4b19-6ec1-4d4f-8020-c8793a30c7e4_3LR1G_6175895",
  "Identity": "Admin User",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": "Admin User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "userType": "Member",
      "agentType": "notAgentic"
    },
    "app": {
      "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
      "displayName": "Microsoft Azure CLI",
      "servicePrincipalId": null,
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Conditional Access",
  "OperationName": "Add conditional access policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "20731088-9073-47c2-a4dc-067c9e681ff3",
      "displayName": "dw-harness-ca-183ecbc8",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "ConditionalAccessPolicy",
          "oldValue": null,
          "newValue": {
            "id": "20731088-9073-47c2-a4dc-067c9e681ff3",
            "displayName": "dw-harness-ca-183ecbc8",
            "createdDateTime": "2026-07-03T03:01:44.2683101+00:00",
            "state": "disabled",
            "conditions": {
              "applications": {
                "includeApplications": [
                  "All"
                ],
                "excludeApplications": [],
                "includeUserActions": [],
                "includeAuthenticationContextClassReferences": [],
                "applicationFilter": null
              },
              "users": {
                "includeUsers": [
                  "None"
                ],
                "excludeUsers": [],
                "includeGroups": [],
                "excludeGroups": [],
                "includeRoles": [],
                "excludeRoles": []
              },
              "userRiskLevels": [],
              "signInRiskLevels": [],
              "clientAppTypes": [
                "all"
              ],
              "servicePrincipalRiskLevels": []
            },
            "grantControls": {
              "operator": "OR",
              "builtInControls": [
                "mfa"
              ],
              "customAuthenticationFactors": [],
              "termsOfUse": []
            }
          }
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

New CA Policy by Non-approved Actor source medium: Monitor and alert on conditional access changes.T1548

Kusto #

Conditional Access - A new Conditional Access policy was created source informational: A new Conditional Access policy was created in Entra ID.T1562, T1562.007

References #

Add named location

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A named location (IP range) was created for Conditional Access.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:20:35.9732581Z",
  "ActivityDisplayName": "Add named location",
  "AdditionalDetails": [
    {
      "key": "Category",
      "value": "Conditional Access"
    }
  ],
  "Category": "Policy",
  "CorrelationId": "c9f2491f-ec74-4b62-a533-eca3768fd0cd",
  "DurationMs": "0",
  "Id": "IPCGraph_c9f2491f-ec74-4b62-a533-eca3768fd0cd_MJL44_23803189",
  "Identity": "Admin User",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": "Admin User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "userType": "Member",
      "agentType": "notAgentic"
    },
    "app": {
      "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
      "displayName": "Microsoft Azure CLI",
      "servicePrincipalId": null,
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Conditional Access",
  "OperationName": "Add named location",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "030aeadf-091c-4e41-8884-120d9069e144",
      "displayName": "dw-harness-nl-cf516524",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "NamedLocation",
          "oldValue": null,
          "newValue": {
            "ipRanges": [
              {
                "@odata.type": "#microsoft.graph.iPv4CidrRange",
                "cidrAddress": "203.0.113.10/24"
              }
            ],
            "isTrusted": false,
            "id": "030aeadf-091c-4e41-8884-120d9069e144",
            "displayName": "dw-harness-nl-cf516524",
            "modifiedDateTime": "2026-07-24T03:20:34.9158613+00:00",
            "createdDateTime": "2026-07-24T03:20:34.9158613+00:00",
            "policyInfo": null
          }
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.T1556, T1556.009↳ also matches Add member to group, Delete conditional access policy, Remove member from group, Update conditional access policy, Update named location

References #

Authentication Methods Policy Update

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

The tenant authentication-methods policy was changed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Certificate-Based Authentication Enabled source medium: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.T1556

References #

Delete conditional access policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A Conditional Access policy was deleted.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-03T03:02:32.3785967Z",
  "ActivityDisplayName": "Delete conditional access policy",
  "AdditionalDetails": [
    {
      "key": "Category",
      "value": "Conditional Access"
    }
  ],
  "Category": "Policy",
  "CorrelationId": "427a0783-aab7-46e0-b14c-127d34db40bf",
  "DurationMs": "0",
  "Id": "IPCGraph_427a0783-aab7-46e0-b14c-127d34db40bf_BP6Z8_6487148",
  "Identity": "Admin User",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": "Admin User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "userType": "Member",
      "agentType": "notAgentic"
    },
    "app": {
      "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
      "displayName": "Microsoft Azure CLI",
      "servicePrincipalId": null,
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Conditional Access",
  "OperationName": "Delete conditional access policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultDescription": "Soft deleted conditional access policy",
  "ResultReason": "Soft deleted conditional access policy",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "20731088-9073-47c2-a4dc-067c9e681ff3",
      "displayName": "dw-harness-ca-183ecbc8",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "ConditionalAccessPolicy",
          "oldValue": {
            "id": "20731088-9073-47c2-a4dc-067c9e681ff3",
            "displayName": "dw-harness-ca-183ecbc8",
            "createdDateTime": "2026-07-03T03:01:44.2683101+00:00",
            "state": "disabled",
            "conditions": {
              "applications": {
                "includeApplications": [
                  "All"
                ],
                "excludeApplications": [],
                "includeUserActions": [],
                "includeAuthenticationContextClassReferences": [],
                "applicationFilter": null
              },
              "users": {
                "includeUsers": [
                  "None"
                ],
                "excludeUsers": [],
                "includeGroups": [],
                "excludeGroups": [],
                "includeRoles": [],
                "excludeRoles": []
              },
              "userRiskLevels": [],
              "signInRiskLevels": [],
              "clientAppTypes": [
                "all"
              ],
              "servicePrincipalRiskLevels": []
            },
            "grantControls": {
              "operator": "OR",
              "builtInControls": [
                "mfa"
              ],
              "customAuthenticationFactors": [],
              "termsOfUse": []
            }
          },
          "newValue": null
        },
        {
          "displayName": "DeletionType",
          "oldValue": null,
          "newValue": "\"SoftDelete\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

CA Policy Removed by Non Approved Actor source medium: Monitor and alert on conditional access changes where non approved actor removed CA Policy.T1548, T1556

Kusto #

Conditional Access - A Conditional Access policy was deleted source low: A Conditional Access policy was deleted from Entra ID.T1562, T1562.007
Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.T1556, T1556.009↳ also matches Add member to group, Add named location, Remove member from group, Update conditional access policy, Update named location

References #

Set device registration policies

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Device registration policies were changed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Changes to Device Registration Policy source high: Monitor and alert for changes to the device registration policy.T1484

References #

Update conditional access policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A Conditional Access policy was modified (tampering can weaken enforcement).

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`stateOld` (kusto rule field)	eq	`enabled`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

CA Policy Updated by Non Approved Actor source medium: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.T1548, T1556

Elastic #

Entra ID Conditional Access Policy (CAP) Modified source high: Identifies a modification to a conditional access policy (CAP) in Microsoft Entra ID. Adversaries may modify existing CAPs to loosen access controls and maintain persistence in the environment with a compromised identity or entity.T1556, T1556.009

Kusto #

Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) source low: A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.T1562, T1562.007
Conditional Access - A Conditional Access app exclusion has changed source low: A Conditional Access app exclusion has changed in Entra ID.T1071
Conditional Access - A Conditional Access policy was disabled source low: A Conditional Access policy was disabled in Entra ID.T1562, T1562.007

Show 4 more (7 total) on the rules page

Panther #

Azure MFA Disabled source high: This detection looks for MFA being disabled in conditional access policyT1078, T1556

References #

Update named location

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A named location was modified.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Detect suspicious conditional access policy modifications source: This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.T1556, T1556.009↳ also matches Add member to group, Add named location, Delete conditional access policy, Remove member from group, Update conditional access policy

References #

Update User Risk and MFA Registration Policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

The user-risk or MFA-registration policy was changed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

User Risk and MFA Registration Policy Updated source high: Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

References #

Accept Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A user accepted a Microsoft Entra Terms of Use agreement, typically when prompted by a Conditional Access policy at sign-in. Each acceptance writes an audit entry; this is primarily a compliance/attestation signal rather than a threat indicator.

References #

Access review ended

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

An access review instance reached the end of its review period and closed, after which pending access decisions are finalized or applied per the review's settings. Part of identity-governance lifecycle auditing.

References #

Add AuthenticationContextClassReference

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A Conditional Access authentication context definition (one of the C1-C99 authentication context class reference values) was created. Authentication contexts let policies enforce requirements such as step-up authentication on sensitive actions or data inside apps, so adding or changing them adjusts where those granular Conditional Access controls apply.

References #

Add blocked user

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A user was added to a block list surfaced in the Microsoft Entra management UX. The only documented Microsoft Entra 'blocked users' list is the legacy multifactor authentication Block/unblock users list, where adding a user auto-denied that account's MFA requests; that legacy feature was removed on March 1, 2025. The mapping of this audit operation to that feature is an inference, not a confirmed fact.

References #

Add bypass user

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that a user was added to a bypass list under a Policy-category operation in the Microsoft Entra management experience. Based on the operation name and category, this most plausibly denotes an authentication or multifactor-authentication bypass exemption that lets the affected user sign in without satisfying that control; the exact policy is not confirmed. Any such bypass weakens authentication controls and is relevant to detection of authentication-control tampering.

References #

Add owner to policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the addition of an owner (a directory object such as a user or service principal) to a directory policy object, granting that principal rights to manage the policy.

References #

Add policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the creation of a directory policy object. The Microsoft Entra policy family includes token lifetime, claims-mapping, home realm discovery, token issuance, activity-based timeout, and authentication flows policies; newly created policies can change authentication or token-issuance behavior and may weaken tenant security posture.

Example Audit Log Entry #

{
  "AADOperationType": "Add",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:20:57.7273109Z",
  "ActivityDisplayName": "Add policy",
  "AdditionalDetails": [
    {
      "key": "User-Agent",
      "value": "python/3.14.5 (Linux-6.1.0-51-amd64-x86_64-with-glibc2.36) AZURECLI/2.88.0 (DEB)"
    }
  ],
  "Category": "Policy",
  "CorrelationId": "61f12a4a-fa8b-4a28-9199-1dec4e77dbe1",
  "DurationMs": "0",
  "Id": "Directory_61f12a4a-fa8b-4a28-9199-1dec4e77dbe1_GH3E7_172502381",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Add policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "6d6b973f-b824-4dd4-91d6-1f8961593a3b",
      "displayName": "dw-harness-hrd-cf516524",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "DisplayName",
          "oldValue": [],
          "newValue": [
            "dw-harness-hrd-cf516524"
          ]
        },
        {
          "displayName": "PolicyType",
          "oldValue": [],
          "newValue": [
            "HomeRealmDiscoveryPolicy"
          ]
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"DisplayName, PolicyType\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Apply decision

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that the outcome of an access-review decision was applied to a reviewed identity, enacting the approve or deny result; for a denied user this removes their reviewed group membership or application assignment.

References #

Approve decision

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a reviewer approving an individual access-review decision, certifying that the reviewed user should keep their access. The last submitted reviewer response is the one recorded when multiple reviewers are assigned.

References #

Bulk Approve decisions

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a reviewer approving multiple access review decisions at once using the bulk Approve action in the access review reviewer experience, attesting that the selected users should retain their access.

References #

Bulk Deny decisions

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a reviewer applying a Deny decision to multiple users at once during an access review. Denied users can have their access removed when the review completes.

References #

Bulk mark decisions as don't know

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a reviewer applying the 'Don't know' decision to multiple users at once during an access review. Per Microsoft, the affected users keep their access and the choice is recorded in the audit logs.

References #

Bulk Reset decisions

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that all reviewer decisions on an access review were reset, which clears the recorded decisions and marks every user as not yet reviewed again.

References #

Cancel request

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A pending request handled by the Microsoft Entra Access Reviews service was cancelled. The audit reference lists this activity under the Access reviews service with the Policy category but does not document its specific payload.

References #

Clear block on user

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A block previously placed on a user account was cleared through the Microsoft Entra (AAD) management UX, reversing the earlier block. The audit reference lists this activity under the Microsoft Entra (AAD) Management UX service with the Policy category but does not document which block type it removes (it sits alongside 'Add blocked user' / 'Add bypass user' in the same section).

References #

Create access review

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the creation of an access review in Microsoft Entra ID Governance, a one-time or recurring review of group membership, application access, or role assignments used to attest to and remove unneeded standing access. Access reviews are a governance control for periodic certification of access.

References #

Create request

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the creation of an access review request in Microsoft Entra access reviews, the configuration that defines a new review of users' access to groups, applications, or roles.

References #

Create Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the creation of a Microsoft Entra Terms of Use policy that can be enforced through Conditional Access to require users to accept terms before accessing resources. Changes to Terms of Use policies are captured in the Microsoft Entra audit logs.

References #

Decline Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a user declining a Microsoft Entra Terms of Use policy. The Terms of Use history and audit logs capture each accept, decline, and expiration per user, and a decline blocks the user from completing access to resources gated by that Terms of Use.

References #

Delete access review

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

An access review was deleted. Access reviews are recurring or one-time recertifications of users' access to groups, applications, or roles, so deleting one removes that recurring attestation control and can weaken governance oversight.

References #

Delete approvals

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the deletion of an approvals object associated with a Microsoft Entra access review. The exact schema of this object is not described in the public audit reference, so it is interpreted conservatively as removal of approval/decision data within the access-reviews governance feature.

References #

Delete AuthenticationContextClassReference

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the deletion of an authentication context class reference (an authentication-context value such as c1) used to target Conditional Access policies at sensitive resources, apps, or protected actions. Removing one can weaken step-up authentication coverage where that context was enforcing stronger controls.

References #

Delete named location

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records deletion of a Conditional Access named location, a named set of IPv4/IPv6 ranges or countries/regions that can optionally be marked trusted. Deleting a named (especially trusted) location can weaken location-based Conditional Access policies and alter Identity Protection risk scoring, a possible defense-evasion action.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:33.8760927Z",
  "ActivityDisplayName": "Delete named location",
  "AdditionalDetails": [
    {
      "key": "Category",
      "value": "Conditional Access"
    }
  ],
  "Category": "Policy",
  "CorrelationId": "8d228957-4053-462f-ad8d-d20a89f93af9",
  "DurationMs": "0",
  "Id": "IPCGraph_8d228957-4053-462f-ad8d-d20a89f93af9_L1I9L_23577405",
  "Identity": "Admin User",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": "Admin User",
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "userType": "Member",
      "agentType": "notAgentic"
    },
    "app": {
      "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
      "displayName": "Microsoft Azure CLI",
      "servicePrincipalId": null,
      "servicePrincipalName": null,
      "agentType": "notAgentic",
      "blueprintId": null
    }
  },
  "LoggedByService": "Conditional Access",
  "OperationName": "Delete named location",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultDescription": "Soft deleted named location",
  "ResultReason": "Soft deleted named location",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "030aeadf-091c-4e41-8884-120d9069e144",
      "displayName": "dw-harness-nl-cf516524",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "NamedLocation",
          "oldValue": {
            "ipRanges": [
              {
                "@odata.type": "#microsoft.graph.iPv4CidrRange",
                "cidrAddress": "203.0.113.10/24"
              }
            ],
            "isTrusted": false,
            "id": "030aeadf-091c-4e41-8884-120d9069e144",
            "displayName": "dw-harness-nl-cf516524",
            "modifiedDateTime": "2026-07-24T03:20:34.9158613+00:00",
            "createdDateTime": "2026-07-24T03:20:34.9158613+00:00",
            "policyInfo": null
          },
          "newValue": null
        },
        {
          "displayName": "DeletionType",
          "oldValue": null,
          "newValue": "\"SoftDelete\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Delete policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the deletion of a directory policy object in the tenant, the generic Microsoft Entra policy resource type covering tenant-wide policies such as token lifetime, app management, or authorization policies. Removal of a security-relevant policy can constitute defense evasion.

Example Audit Log Entry #

{
  "AADOperationType": "Delete",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:33.6015442Z",
  "ActivityDisplayName": "Delete policy",
  "AdditionalDetails": [],
  "Category": "Policy",
  "CorrelationId": "c12da1f5-188b-48a6-ba02-70dc43f9bc94",
  "DurationMs": "0",
  "Id": "Directory_c12da1f5-188b-48a6-ba02-70dc43f9bc94_O4VOL_159467525",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Delete policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "bedcdff7-8c94-4dee-ada5-704741a5e2d2",
      "displayName": "dw-harness-nl-cf516524",
      "type": "Policy",
      "modifiedProperties": [],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Delete Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records deletion of a Microsoft Entra terms of use agreement (Policy category). Because a terms-of-use policy provides an acceptance gate that Conditional Access can require at sign-in, removing it eliminates that consent/compliance enforcement point.

References #

Deny decision

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a reviewer denying a single decision in a Microsoft Entra access review. A denied user is not removed immediately but loses the reviewed access when the review period ends or when an administrator stops the review.

References #

Don't know decision

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A reviewer recorded a 'Don't know' decision for a user in an access review; the user keeps their existing access and the indecision is logged for other reviewers and auditors.

References #

Edit Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

An existing Terms of Use agreement was edited in Microsoft Entra ID, such as a change to its name, display name, document version, or added language. Terms of Use changes are captured in the Microsoft Entra audit logs and can affect Conditional Access policies that require acceptance, so unexpected edits are worth review.

References #

Hard Delete policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the permanent (hard) deletion of a directory policy object from the Microsoft Entra tenant (for example a token-lifetime, claims-mapping, home-realm-discovery, or authorization policy). Such policy objects do not support soft delete, so the deletion is irreversible; removing a security-relevant policy can be associated with defense evasion.

References #

Publish Terms Of Use

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records the creation and publishing of a Microsoft Entra terms of use agreement, making the uploaded terms (PDF) available to enforce through Conditional Access before users can access resources. Changes to terms of use affect access-governance enforcement.

References #

Remove bypassed user

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records removal of a user from a multifactor authentication (MFA) bypass list, the set of users exempted from completing an MFA challenge. Removing the user ends that exemption. Changes to MFA bypass lists are security-relevant because they alter who is excused from MFA enforcement.

References #

Remove owner from policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that an owner was removed from a Microsoft Entra directory policy object, changing which principal is authorized to manage that policy.

References #

Remove policy credentials

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that credentials associated with a Microsoft Entra policy object were removed.

References #

Request expired

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that an access review request or instance expired, reaching its scheduled end without a decision being completed. Useful for spotting reviews that lapsed without an explicit approve or deny choice.

References #

Reset decision

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records that a previously recorded access review decision was reset, clearing the reviewer's earlier approve or deny choice and returning that user's entry to an undecided state so it can be reviewed again.

References #

Restore policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A directory policy object was restored in the Core Directory service. Restoring a policy can re-enable a configuration that had previously been removed, which bears on defense-evasion and policy-integrity monitoring.

References #

Update access review

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records modification of an access review in Microsoft Entra, a one-time or recurring review of identities' access to groups, applications, or directory roles. Disabling or altering a review can weaken access governance and is relevant to defense evasion.

References #

Update AuthenticationContextClassReference

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a change to a Conditional Access authentication context class reference, a custom value used to trigger Conditional Access requirements (such as step-up authentication) on sensitive resources or actions. Modifying or unpublishing one can weaken the protections tied to that authentication context.

References #

Update continuous access evaluation

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Records a change to the continuous access evaluation (CAE) setting within a Conditional Access policy, which governs near-real-time enforcement of token revocation and critical security events. Disabling or weakening CAE reduces real-time session revocation, so changes are relevant to defense-evasion and session-persistence monitoring.

References #

Update partner directory settings

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

Settings that govern access reviews of a partner (external) directory's users were updated, part of configuring guest and cross-tenant access review policy. The exact policy object behind this operation was not confirmed against a Learn doc.

References #

Update policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

A directory policy object was updated in Core Directory. The operation name alone does not convey the specific policy type affected.

Example Audit Log Entry #

{
  "AADOperationType": "Update",
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "ActivityDateTime": "2026-07-24T03:21:33.8067146Z",
  "ActivityDisplayName": "Update policy",
  "AdditionalDetails": [],
  "Category": "Policy",
  "CorrelationId": "ad10b7cb-6139-472a-8391-cfad1552fd7d",
  "DurationMs": "0",
  "Id": "Directory_ad10b7cb-6139-472a-8391-cfad1552fd7d_PPCTH_148619167",
  "InitiatedBy": {
    "user": {
      "id": "aaaaaaaa-0000-0000-0000-000000000001",
      "displayName": null,
      "userPrincipalName": "adminuser@example.onmicrosoft.com",
      "ipAddress": "203.0.113.10",
      "roles": [],
      "agentType": "notAgentic"
    }
  },
  "LoggedByService": "Core Directory",
  "OperationName": "Update policy",
  "OperationVersion": "1.0",
  "Resource": "Microsoft.aadiam",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "Result": "success",
  "ResultSignature": "None",
  "TargetResources": [
    {
      "id": "12b1e3b4-7e38-4b24-a740-186a3e9e8556",
      "displayName": "Known Networks List",
      "type": "Policy",
      "modifiedProperties": [
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"\""
        }
      ],
      "administrativeUnits": [],
      "agentType": "notAgentic"
    }
  ]
}

References #

Update request

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

An access review request was updated in the access reviews service. The operation name does not convey which attributes of the review were changed.

References #

Update security defaults

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

The tenant-wide security defaults setting was enabled or disabled. Security defaults enforce baseline protections such as required MFA registration and blocking legacy authentication, so disabling it weakens the tenant's posture and is relevant to defense-evasion detection.

References #

Update Sign-In Risk Policy

Source: Microsoft Entra ID audit log
Audit Category: Policy

Description

The sign-in risk policy was updated. This Microsoft Entra ID Protection policy applies access controls (such as requiring MFA or blocking access) when a sign-in is evaluated as risky, so weakening or disabling it reduces automated risk response and is relevant to defense-evasion detection.

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.

Audit Logs: Policy

Add conditional access policy

Description

Example Audit Log Entry #

Detection Rules #

Sigma #

Kusto #

References #

Add named location

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Kusto #

References #

Authentication Methods Policy Update

Description

Detection Rules #

Sigma #

References #

Delete conditional access policy

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Sigma #

Kusto #

References #

Set device registration policies

Description

Detection Rules #

Sigma #

References #

Update conditional access policy

Description

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Kusto #

Panther #

References #

Update named location

Description

Related events #

Detection Rules #

Kusto #

References #

Update User Risk and MFA Registration Policy

Description

Detection Rules #

Sigma #

References #

Accept Terms Of Use

Description

References #

Access review ended

Description

References #

Add AuthenticationContextClassReference

Description

References #

Add blocked user

Description

References #

Add bypass user

Description

References #

Add owner to policy

Description

References #

Add policy

Description

Example Audit Log Entry #

References #

Apply decision

Description

References #

Approve decision