Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: ProvisioningManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Other | A provisioning-service action that does not map to a standard Create/Update/Delete/Disable/StagedDelete action type. | N | N |
| Add provisioning configuration | A new application, HR, or cross-tenant provisioning configuration was created. | N | N |
| Delete provisioning configuration | A provisioning configuration was deleted. | N | N |
| Disable/pause provisioning configuration | The provisioning job was disabled or paused. | N | N |
| Enable/restart provisioning configuration | The provisioning job was restarted. | N | N |
| Enable/start provisioning configuration | The provisioning job was started. | N | N |
| Execution | The provisioning job is executing a synchronization cycle. | N | N |
| Export | The provisioning job exported a change (for example, creating a user) to the target system. | N | N |
| Import | The provisioning job imported an object's properties from the source system. | N | N |
| Process escrow | The provisioning service could not export a change to the target application and is retrying the operation. | N | N |
| Quarantine | The provisioning job is running at reduced frequency because of a problem such as lost connectivity to the target application. | N | N |
| Synchronization rule action | The provisioning service evaluated an object and did not export a change to the target system. | N | N |
| Update attribute mappings or scope | The attribute mappings or scoping rules for the provisioning job were updated. | N | N |
| Update provisioning setting or credentials | A provisioning job's settings (for example, notification email, sync scope, accidental-deletions prevention) or credentials (for example, a bearer token) were updated. | N | N |
| User Provisioning | The provisioning job's schema was restored to its default. | N | N |
Other
#Description
A catch-all account-provisioning audit record for an action that does not map to a standard provisioning action type (Create, Update, Delete, Disable, or StagedDelete). It is emitted by the Microsoft Entra provisioning service for operations that fall outside those defined categories, for example when source and target already match so no change is made.
References #
Add provisioning configuration
#Description
A new application, HR, or cross-tenant provisioning configuration was created.
References #
Disable/pause provisioning configuration
#Description
The provisioning job was disabled or paused.
References #
Enable/restart provisioning configuration
#Description
The provisioning job was restarted.
References #
Execution
#Description
Records that the provisioning job is executing. The underlying provisioning-logs event this activity groups can be ProvisioningJobStartedInitialSync, ProvisioningJobStartedIncrementalSync, ProvisioningJobComplete, or ProvisioningJobDisabled.
References #
Export
#Description
The provisioning job exported a change (for example, creating a user) to the target system.
References #
Import
#Description
For example, importing a user's properties in Microsoft Entra ID before provisioning that user's account into a target system such as Salesforce.
References #
Process escrow
#Description
The provisioning service could not export a change to the target application and is retrying the operation.
References #
Quarantine
#Description
The provisioning job is running at reduced frequency because of a problem such as lost connectivity to the target application.
References #
Synchronization rule action
#Description
Most often emitted when a user is skipped because the user is out of scope for provisioning.
References #
Update attribute mappings or scope
#Description
The attribute mappings or scoping rules for the provisioning job were updated.
References #
Update provisioning setting or credentials
#Description
A provisioning job's settings (for example, notification email, sync scope, accidental-deletions prevention) or credentials (for example, a bearer token) were updated.
References #
User Provisioning
#Description
Carried faithfully from the source doc, whose description for this activity ("The schema for the provisioning job has been restored to the default.") reads like a copy-paste mismatch against the "User Provisioning" activity name. This is worth an upstream correction request; the wording is not reinterpreted here.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.