Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: PublicKeyInfrastructure
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Create Public | Creation of a PKI trust-store container for certificate-based authentication (holds the trusted CAs that issue user certificates). | N | N |
| Delete Public | Deletion of a PKI container (trusted root/intermediate CAs) from the Entra certificate-based-auth trust store. | N | N |
| Hard Delete Public | Permanent deletion of a certificate-based-authentication PKI (CA trust store) from the tenant. | N | N |
| Initiate Public | Creation of a certificate-based-authentication PKI (CA trust store) in the tenant. | N | N |
| Restore Public | A PKI object was restored in the Entra certificate-based authentication (CBA) trust store. | N | N |
| Update Public | A PKI object (CA trust store) for certificate-based authentication was updated. | N | N |
Create PublicKeyInfrastructure
#Description
Records the creation of a Public Key Infrastructure (PKI) container in the Microsoft Entra certificate-based authentication trust store, used to upload and manage the certificate authorities (root and intermediate CAs) whose issued user certificates are trusted for Entra CBA. Changes to the trusted-CA set are security-relevant because an unexpected or rogue CA could enable certificate-based authentication abuse.
References #
Delete PublicKeyInfrastructure
#Description
Records the deletion of a PKI (public key infrastructure) container object from the Microsoft Entra certificate-based authentication trust store. The container holds the root and intermediate certificate authorities trusted for CBA, so its removal affects which client certificates can be used to authenticate users.
References #
Hard Delete PublicKeyInfrastructure
#Description
Records the permanent deletion of a PKI (a multi-level certificate-authority trust store) used for Microsoft Entra certificate-based authentication. Removing the PKI strips the trusted CA chain that validates user certificates, which can disable or weaken certificate-based sign-in (potential defense evasion or denial of a strong authentication method).
References #
Initiate PublicKeyInfrastructure
#Description
Records the creation (initiation) of a PKI (a multi-level certificate-authority trust store) for Microsoft Entra certificate-based authentication, the configuration that establishes the trusted CA chain used to validate user certificates during sign-in.
References #
Restore PublicKeyInfrastructure
#Description
A Public Key Infrastructure object was restored in the Microsoft Entra certificate-based authentication (CBA) trust store, which holds the certificate authorities trusted for CBA. Changes to the CBA trust store affect which certificates can authenticate users, making them relevant to authentication-integrity monitoring.
References #
Update PublicKeyInfrastructure
#Description
A public key infrastructure (PKI) object in the certificate-based authentication trust store was updated. The PKI store holds the certificate authorities used to validate user certificates, so changes to trusted CAs can affect certificate-based authentication trust.
References #
Computed Fields in AuditLogs #
Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.
Initiating*values come fromInitiatedBy:InitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, orInitiatedBy.user.id; application actors useInitiatedBy.app.displayNameorInitiatedBy.app.appId.- Change details come from
TargetResources[].modifiedProperties. ExpandTargetResourcesbefore usingdisplayName,oldValue, ornewValue.
Sources: the AuditLogs table reference and Graph directoryAudit resource.