Audit Logs / Microsoft Entra ID AuditLogs category
Audit Logs: ResourceManagement
| OperationName | Description | Sample | Rule |
|---|---|---|---|
| Add a Connector to Connector Group | An Application Proxy connector was assigned to a connector group used to publish on-premises applications. | N | N |
| Add application SSL certificate | A TLS/SSL (PFX) certificate was uploaded for an application proxy published app using a custom domain. | N | N |
| Add connector Group | An application proxy connector group (a named set of connectors that published apps are assigned to) was created. | N | N |
| Add eligible member to role in PIM canceled (permanent) | A request to create a permanent eligible PIM role assignment was canceled before completion. | N | N |
| Create authority | A Verified ID authority (issuer instance with its own DID and Key Vault signing key) was created. | N | N |
| Create authorization policy | An authorization policy was created within the Verified ID service (exact object undocumented; likely set during onboarding). | N | N |
| Create contract | Creation of a Verified ID credential contract defining the issuance rules/display for a verifiable-credential type. | N | N |
| Create issuance policy | An issuance configuration (credential contract) was created for Microsoft Entra Verified ID. | N | N |
| Create or update a localized resource | A localized (language-customization) resource was created or updated in Azure AD B2C. | N | N |
| Create Registration of Security Provider | Registration of a security provider resource in Global Secure Access (Security Service Edge provisioning). | N | N |
| Deactivate PIM alert | Deactivation/dismissal of a PIM security alert that flags suspicious or unsafe privileged-role activity. | N | N |
| Delete Connector Group | An Application Proxy connector group was deleted. | N | N |
| Delete issuance policy | Deletes a Microsoft Entra Verified ID issuance policy that governs how a verifiable credential is issued. | N | N |
| Delete SSL binding | Removes the TLS/SSL certificate binding for an application proxy custom domain. | N | N |
| Disable PIM alert | A PIM security alert was disabled in alert settings, so PIM no longer raises that alert for the matching condition. | N | Y |
| Enable PIM alert | Records enabling of a Privileged Identity Management security alert that flags suspicious privileged-role activity. | N | N |
| Get B2 | The B2C tenant where the caller is an administrator was retrieved. | N | N |
| Get Guest Usages directory resources in a resource group | Lists Guest Usages (MAU billing-link) directory resources within an Azure resource group. | N | N |
| Get Guest Usages directory resources in a subscription | Lists Guest Usages (MAU billing-link) directory resources across an Azure subscription. | N | N |
| Get Guest Usages resource | Reads a single Guest Usages (MAU billing-link) directory resource. | N | N |
| Get operation status of an async operation | Read of the status of an asynchronous B2C resource-management operation (control-plane status poll). | N | N |
| Identity Provider | CRUD operation on an Azure AD B2C identity provider resource (external IdP configuration). | N | N |
| Onboarded resource from PIM | An Azure resource was onboarded into Privileged Identity Management for just-in-time role governance. | N | N |
| Process POST /authorities/:issuer | A new signing key was rotated into Key Vault for a Verified ID authority's decentralized identifier (DID). | N | N |
| Process POST /authorities/:issuer | A Verified ID authority synchronized its signing keys with the published DID document, switching to the new key on match. | N | N |
| Process role update request | PIM processed an update to a privileged role assignment (extend, renew, or modify). | N | N |
| Register connector | An Application Proxy connector was registered to the tenant. | N | N |
| Resolve PIM alert | An administrator resolved a Privileged Identity Management (PIM) security alert. | N | N |
| Restore permanent eligible role assignment | A permanent eligible role assignment was restored through Privileged Identity Management. | N | N |
| Revoke credential | An issued verifiable credential was revoked by its issuer in Microsoft Entra Verified ID. | N | N |
| Rotate signing key | A Microsoft Entra Verified ID issuer signing key was rotated (new signing key created). | N | N |
| Tenant offboarded from PIM | A tenant was offboarded from Privileged Identity Management (PIM). | N | N |
| Tenant onboarding | A tenant was onboarded to Microsoft Entra Verified ID (provisions its issuer/DID environment). | N | N |
| Tenant opt-out | A tenant opted out of Verified ID; deletes its DID and credential contracts (one-way reset). | N | N |
| Triggered PIM alert | PIM raised a security alert for suspicious or unsafe privileged-access activity. | N | N |
| Update authority | Records a change to a Microsoft Entra Verified ID authority (the tenant's issuing/verifying entity). | N | N |
| Update B2 | Records an update to a directory-level resource in an Azure AD B2C tenant. | N | N |
| Update certificate to policy key | Upload/update of a certificate into an Azure AD B2C policy key (keyset) container. | N | N |
| Update CIAM directory resource | Update to a directory resource in a customer identity (CIAM / External ID) tenant. | N | N |
| Update Connector Group | Change to an Application Proxy connector group (grouping of connectors). | N | N |
| Update contract | A Verified ID issuance contract (rules and display definitions) was updated. | N | N |
| Update Guest Usages resource | The Guest Usages billing resource linking a B2C/External Identities tenant to an Azure subscription was updated. | N | N |
| Update issuance policy | Change to an Entra Verified ID credential issuance configuration (rules/display for issuing a verifiable credential). | N | N |
| Update linked domains | Change to the domains linked to an Entra Verified ID DID (issuer-to-domain trust binding). | N | N |
| Update My | Verified ID settings controlling MyAccount self-issuance of Workplace Credentials were updated. | N | N |
| Update secret into policy key | A secret value was updated in an Azure AD B2C Identity Experience Framework policy key. | N | N |
Add a Connector to Connector Group
#Description
An Application Proxy connector was assigned to a connector group, which governs how that group's connectors serve published on-premises applications. Changes to connectors and connector groups alter how internal apps are exposed for remote access, so unexpected changes can indicate tampering with remote-access infrastructure.
References #
Add application SSL certificate
#Description
A TLS/SSL certificate (PFX) was uploaded for a Microsoft Entra application proxy published application that uses a custom domain. The certificate lets the proxy serve the application's external URL under the organization's own domain name.
References #
Add connector Group
#Description
An application proxy connector group was created. Connector groups organize application proxy connectors so that publishing of specific on-premises applications can be assigned to a chosen set of connectors, for example by region or network segment.
References #
Add eligible member to role in PIM canceled (permanent)
#Description
A request to create a permanent eligible role assignment in Privileged Identity Management was canceled before completion. An eligible (rather than active) assignment would have let the member activate the role on demand; because the request was canceled, no eligible assignment was created.
References #
Create contract
#Description
A Verified ID credential contract was created, defining the issuance configuration (rules and display definitions) for a verifiable-credential type the tenant can issue. The contract governs which claims are collected and attested when credentials of that type are issued.
References #
Create issuance policy
#Description
An issuance configuration was created for Microsoft Entra Verified ID, defining how an issuing authority issues a verifiable credential (its rules definition for collecting claims and its display definition). This records setup of credential issuance under a Verified ID authority.
References #
Create or update a localized resource
#Description
A localized resource was created or updated in the Azure AD B2C tenant, the language-customization content (translated user-flow or custom-policy UI strings) used to localize the sign-in and sign-up experience.
References #
Create Registration of Security Provider
#Description
Records the registration of a security provider resource within Microsoft Entra Global Secure Access, part of provisioning the Security Service Edge configuration for the tenant. The precise provider scope is not detailed in retrieved documentation.
References #
Deactivate PIM alert
#Description
Records the deactivation or dismissal of a Privileged Identity Management security alert. PIM raises these alerts on suspicious or unsafe privileged-role activity (for example roles assigned outside PIM, too many Global Administrators, or stale accounts in a privileged role). Suppressing or dismissing such alerts reduces visibility into risky privileged-role changes, so the event is relevant to defense-evasion monitoring.
References #
Delete Connector Group
#Description
An Application Proxy connector group was deleted. Connector groups organize the on-premises connectors that publish internal applications through Microsoft Entra application proxy.
References #
Delete issuance policy
#Description
Records deletion of a Microsoft Entra Verified ID issuance policy, the tenant configuration that governs how a verifiable credential is issued. Described from the operation name, category, and service; the exact object semantics were not confirmed against a specific Learn page.
References #
Delete SSL binding
#Description
Records removal of the TLS/SSL certificate binding for a Microsoft Entra application proxy custom domain. Application proxy custom domains require an uploaded PFX certificate bound to the external URL so a published app can serve TLS under the organization's own domain name instead of the default msappproxy.net domain, so removing this binding can weaken or disrupt the TLS configuration of an externally published application.
References #
Disable PIM alert
#Description
A Privileged Identity Management (PIM) security alert was disabled in PIM alert settings, so PIM no longer raises that alert (or its email notification) for the matching condition. Disabling a privileged-access alert can be a defense-evasion step that hides unsafe role-assignment activity from reviewers.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1078
References #
Enable PIM alert
#Description
Records that an administrator enabled a Privileged Identity Management security alert, which flags suspicious or unsafe privileged-role activity (for example, roles being assigned outside PIM or potentially stale accounts in a privileged role). Because these alerts underpin monitoring of privileged access, changes to their enabled state are relevant to detecting tampering with privileged-access controls.
References #
Get B2C Tenant where the caller is an administrator
#Description
Records a lookup of the single B2C tenant for which the calling identity holds administrator rights. This is a read-only ResourceManagement activity used to resolve the caller's administered B2C tenant.
References #
Get Guest Usages directory resources in a resource group
#Description
Records listing the Guest Usages directory resources (Microsoft.AzureActiveDirectory/guestUsages resources) within an Azure resource group. A guestUsages resource is the billing-link object created in a resource group when an external-identities tenant (Microsoft Entra B2B guest collaboration / Azure AD B2C) is linked to an Azure subscription for monthly-active-user (MAU) metering. Read-only ResourceManagement (Azure Resource Manager) activity.
References #
Get Guest Usages directory resources in a subscription
#Description
Records listing the Guest Usages directory resources (Microsoft.AzureActiveDirectory/guestUsages monthly-active-user billing-link resources) across an Azure subscription. Each guestUsages resource links an external-identities tenant (Microsoft Entra B2B guest collaboration / Azure AD B2C) to the subscription for MAU metering. Read-only ResourceManagement (Azure Resource Manager) activity.
References #
Get Guest Usages resource
#Description
Records reading a single Guest Usages directory resource, a Microsoft.AzureActiveDirectory/guestUsages resource that links an external-identities tenant (Microsoft Entra B2B guest collaboration / Azure AD B2C) to an Azure subscription for monthly-active-user (MAU) billing. Read-only ResourceManagement (Azure Resource Manager) activity.
References #
Get operation status of an async operation
#Description
Records a read of the status of a long-running (asynchronous) resource-management operation for Azure AD B2C, the poll against the operation-status endpoint returned when a prior request started an async job (for example provisioning or deleting a B2C tenant resource). It is routine control-plane polling and low-signal on its own.
References #
Identity Provider
#Description
Records a create, read, update, or delete operation on an identity provider resource in an Azure AD B2C tenant (an external IdP such as a social or SAML/OIDC provider used by user flows and custom policies). Changes to an identity provider can alter which external accounts can authenticate to B2C applications.
References #
Onboarded resource from PIM
#Description
Records that an Azure resource was onboarded into Privileged Identity Management so PIM governs eligible and active role assignments on it; onboarding configures PIM to manage the resource and all of its existing and new child objects, and the PIM service principal (MS-PIM) is assigned as User Access Administrator on the resource. Changes to which resources PIM manages affect the scope of just-in-time privileged access.
References #
Process role update request
#Description
Records Privileged Identity Management processing an update to a role assignment, such as extending, renewing, or modifying an existing privileged assignment. Changes to privileged-role assignment lifetime or scope are relevant to standing-access monitoring.
References #
Register connector
#Description
An Application Proxy connector was registered to the tenant, joining a new on-premises connector to the Microsoft Entra Application Proxy service so it can publish internal applications for remote access. Because a connector enables external reach to internal apps, an unexpected registration can be relevant to persistence and unauthorized-access monitoring.
References #
Resolve PIM alert
#Description
Records that an administrator resolved a Privileged Identity Management security alert, such as one flagging too many Global Administrators, potential stale accounts in a privileged role, or roles assigned outside of PIM. Resolving marks the alert as handled in the PIM dashboard, so analysts should confirm the underlying privileged-access condition was actually remediated rather than merely dismissed.
References #
Restore permanent eligible role assignment
#Description
A permanent eligible role assignment was restored through Privileged Identity Management, reinstating the principal's eligibility to activate the privileged role on demand. Restored eligibility for a privileged role is relevant to privilege-escalation and persistence monitoring.
References #
Revoke credential
#Description
An issued verifiable credential was revoked by its issuer in Microsoft Entra Verified ID, setting the credential's revocation status (StatusList2021) so that later presentations report it as revoked.
References #
Rotate signing key
#Description
A Microsoft Entra Verified ID issuer signing key was rotated, creating a new current signing key in Key Vault for the did:web authority while moving the prior key to older keys. Signing-key changes affect the trust of issued credentials and tokens.
References #
Tenant offboarded from PIM
#Description
Records that a tenant (or its resources) was offboarded from Privileged Identity Management, ending PIM management for that scope. The specific offboarding flow is not described in public Microsoft Learn material, so scope is interpreted from the operation name and ResourceManagement/PIM service.
References #
Tenant onboarding
#Description
Records onboarding a tenant to Microsoft Entra Verified ID, which provisions the tenant's issuer environment and decentralized identifier (DID) so it can issue and verify verifiable credentials.
References #
Tenant opt-out
#Description
Records a tenant opting out of Microsoft Entra Verified ID, a one-way reset that deletes the tenant's decentralized identifier (DID) and its verifiable-credential contracts from the service. Re-enabling the service requires onboarding again into a new environment.
References #
Triggered PIM alert
#Description
Records that Privileged Identity Management raised a security alert in response to suspicious or unsafe privileged-access activity, such as a privileged role assigned outside PIM, too many administrators, or stale/standing assignments. These alerts are a direct privileged-access abuse signal useful for detection.
References #
Update B2C directory resource
#Description
Records an update to a directory-level resource within an Azure AD B2C tenant. The audit name does not by itself identify which specific B2C directory resource changed.
References #
Update certificate to policy key
#Description
Records uploading or updating a certificate within an Azure AD B2C policy key (keyset) container. B2C stores certificates and secrets as policy keys used for token signing, encryption, and establishing trust with external identity providers and REST services, so changes to these keys can affect token-signing trust.
References #
Update CIAM directory resource
#Description
Records an update to a directory resource in a Microsoft Entra customer identity (CIAM / External ID) tenant. The specific resource is not identified by the operation name alone, so this should be treated as a generic configuration change within a customer-facing identity directory.
References #
Update Connector Group
#Description
Records a change to a Microsoft Entra Application Proxy connector group, a named grouping of connectors that serves a set of published on-premises applications. Connector group changes affect which connectors serve which apps and how on-premises application traffic is routed.
References #
Update contract
#Description
A Microsoft Entra Verified ID issuance contract was updated: the rules and display definitions that control how a verifiable credential is issued and how its claims are rendered.
References #
Update Guest Usages resource
#Description
The Guest Usages resource that links a Microsoft Entra B2C / External Identities tenant to an Azure subscription for monthly active user (MAU) billing was updated. The event reflects a change to the billing association between the directory and its Azure subscription rather than a change to identity objects inside the tenant.
References #
Update issuance policy
#Description
Records a change to a Microsoft Entra Verified ID credential issuance configuration (the rules and display definitions that control how a verifiable credential is issued, including which claims and attestations it carries). Altering issuance rules affects the contents and trust of credentials the tenant issues.
References #
Update linked domains
#Description
Records a change to the set of domains linked to a Microsoft Entra Verified ID authority's decentralized identifier (DID). The linked domain binds the DID to a web domain through a hosted did-configuration.json file, establishing issuer-to-domain trust for verifiable credentials.
References #
Update MyAccount settings
#Description
Microsoft Entra Verified ID settings that control the MyAccount (myaccount.microsoft.com) credential experience were updated, for example removing the self-issuance option or selecting which groups of users may issue themselves a Verified Workplace Credential.
References #
Update secret into policy key
#Description
A secret value was updated within an Azure AD B2C policy key. Policy keys are Azure AD B2C containers (managed under the Identity Experience Framework and used by custom policies) that store secrets and certificates used to establish trust with the services it integrates with, so this change affects custom-policy signing and external integrations.
References #
Rules often query computed field names, not native AuditLogs columns #
Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.
InitiatingUserPrincipalName(and siblingInitiating*names) is not a column. Rules project it fromInitiatedBy, for exampleextend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths areInitiatedBy.user.userPrincipalName,InitiatedBy.user.displayName, andInitiatedBy.user.idfor user actors, andInitiatedBy.app.displayName/InitiatedBy.app.appIdfor application or service-principal actors.- What changed lives in
TargetResources, adynamicarray. Expand it before filtering on the change:AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then readprops[].displayName,props[].oldValue, andprops[].newValue.
Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.