Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: ProvisioningManagement

OperationName	Description	Sample	Rule
Other	A provisioning-service action that does not map to a standard Create/Update/Delete/Disable/StagedDelete action type.	N	N
Add provisioning configuration	A new application, HR, or cross-tenant provisioning configuration was created.	N	N
Delete provisioning configuration	A provisioning configuration was deleted.	N	N
Disable/pause provisioning configuration	The provisioning job was disabled or paused.	N	N
Enable/restart provisioning configuration	The provisioning job was restarted.	N	N
Enable/start provisioning configuration	The provisioning job was started.	N	N
Execution	The provisioning job is executing a synchronization cycle.	N	N
Export	The provisioning job exported a change (for example, creating a user) to the target system.	N	N
Import	The provisioning job imported an object's properties from the source system.	N	N
Process escrow	The provisioning service could not export a change to the target application and is retrying the operation.	N	N
Quarantine	The provisioning job is running at reduced frequency because of a problem such as lost connectivity to the target application.	N	N
Synchronization rule action	The provisioning service evaluated an object and did not export a change to the target system.	N	N
Update attribute mappings or scope	The attribute mappings or scoping rules for the provisioning job were updated.	N	N
Update provisioning setting or credentials	A provisioning job's settings (for example, notification email, sync scope, accidental-deletions prevention) or credentials (for example, a bearer token) were updated.	N	N
User Provisioning	The provisioning job's schema was restored to its default.	N	N

Other

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

A catch-all account-provisioning audit record for an action that does not map to a standard provisioning action type (Create, Update, Delete, Disable, or StagedDelete). It is emitted by the Microsoft Entra provisioning service for operations that fall outside those defined categories, for example when source and target already match so no change is made.

References #

Add provisioning configuration

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

A new application, HR, or cross-tenant provisioning configuration was created.

References #

Delete provisioning configuration

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

A provisioning configuration was deleted.

References #

Disable/pause provisioning configuration

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning job was disabled or paused.

References #

Enable/restart provisioning configuration

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning job was restarted.

References #

Enable/start provisioning configuration

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning job was started.

References #

Execution

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

Records that the provisioning job is executing. The underlying provisioning-logs event this activity groups can be ProvisioningJobStartedInitialSync, ProvisioningJobStartedIncrementalSync, ProvisioningJobComplete, or ProvisioningJobDisabled.

References #

Export

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning job exported a change (for example, creating a user) to the target system.

References #

Import

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

For example, importing a user's properties in Microsoft Entra ID before provisioning that user's account into a target system such as Salesforce.

References #

Process escrow

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning service could not export a change to the target application and is retrying the operation.

References #

Quarantine

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The provisioning job is running at reduced frequency because of a problem such as lost connectivity to the target application.

References #

Synchronization rule action

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

Most often emitted when a user is skipped because the user is out of scope for provisioning.

References #

Update attribute mappings or scope

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

The attribute mappings or scoping rules for the provisioning job were updated.

References #

Update provisioning setting or credentials

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

A provisioning job's settings (for example, notification email, sync scope, accidental-deletions prevention) or credentials (for example, a bearer token) were updated.

References #

User Provisioning

Source: Microsoft Entra ID audit log
Audit Category: ProvisioningManagement

Description

Carried faithfully from the source doc, whose description for this activity ("The schema for the provisioning job has been restored to the default.") reads like a copy-paste mismatch against the "User Provisioning" activity name. This is worth an upstream correction request; the wording is not reinterpreted here.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.