Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: PublicKeyInfrastructure
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Create Public | Creation of a PKI trust-store container for certificate-based authentication (holds the trusted CAs that issue user certificates). | N | N |
| Delete Public | Deletion of a PKI container (trusted root/intermediate CAs) from the Entra certificate-based-auth trust store. | N | N |
| Hard Delete Public | Permanent deletion of a certificate-based-authentication PKI (CA trust store) from the tenant. | N | N |
| Initiate Public | Creation of a certificate-based-authentication PKI (CA trust store) in the tenant. | N | N |
| Restore Public | A PKI object was restored in the Entra certificate-based authentication (CBA) trust store. | N | N |
| Update Public | A PKI object (CA trust store) for certificate-based authentication was updated. | N | N |
Create PublicKeyInfrastructure
#Description
Records the creation of a Public Key Infrastructure (PKI) container in the Microsoft Entra certificate-based authentication trust store, used to upload and manage the certificate authorities (root and intermediate CAs) whose issued user certificates are trusted for Entra CBA. Changes to the trusted-CA set are security-relevant because an unexpected or rogue CA could enable certificate-based authentication abuse.
References #
Delete PublicKeyInfrastructure
#Description
Records the deletion of a PKI (public key infrastructure) container object from the Microsoft Entra certificate-based authentication trust store. The container holds the root and intermediate certificate authorities trusted for CBA, so its removal affects which client certificates can be used to authenticate users.
References #
Hard Delete PublicKeyInfrastructure
#Description
Records the permanent deletion of a PKI (a multi-level certificate-authority trust store) used for Microsoft Entra certificate-based authentication. Removing the PKI strips the trusted CA chain that validates user certificates, which can disable or weaken certificate-based sign-in (potential defense evasion or denial of a strong authentication method).
References #
Initiate PublicKeyInfrastructure
#Description
Records the creation (initiation) of a PKI (a multi-level certificate-authority trust store) for Microsoft Entra certificate-based authentication, the configuration that establishes the trusted CA chain used to validate user certificates during sign-in.
References #
Restore PublicKeyInfrastructure
#Description
A Public Key Infrastructure object was restored in the Microsoft Entra certificate-based authentication (CBA) trust store, which holds the certificate authorities trusted for CBA. Changes to the CBA trust store affect which certificates can authenticate users, making them relevant to authentication-integrity monitoring.
References #
Update PublicKeyInfrastructure
#Description
A public key infrastructure (PKI) object in the certificate-based authentication trust store was updated. The PKI store holds the certificate authorities used to validate user certificates, so changes to trusted CAs can affect certificate-based authentication trust.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.