detection.wiki

Intune-Role

EventSampleRule
Role (catch-all)NN
Create RoleDefinitionYN
Delete RoleDefinitionYN
Create RoleScopeTagYN
Delete RoleScopeTagYN

any: Role (catch-all)

#

Description

Synthetic aggregation for Intune audit rules that filter the Role category without a specific activityType. Not a distinct audit record.

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Create RoleDefinition

#

Description

Create Role definition

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "5d07b535-852c-4592-bed3-878dcfdda3fc",
  "displayName": "Create Role definition",
  "componentName": "RoleBasedAccessControl",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:10.6572614Z",
  "activityType": "Create RoleDefinition",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "e1506440-dcfb-4923-b891-9415d1f96680",
  "category": "Role",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "DeviceAndAppManagementRoleDefinition",
      "resourceId": "da32056b-f3e2-430c-9aa8-ba25fbc1d68d",
      "modifiedProperties": [
        {
          "displayName": "resourcePermissions",
          "oldValue": null,
          "newValue": "Microsoft.Intune/MobileApps/Read"
        },
        {
          "displayName": "description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "da32056b-f3e2-430c-9aa8-ba25fbc1d68d"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "IsBuiltIn",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2017-11-17"
        },
        {
          "displayName": "$Collection.RolePermissions.ResourceActions.AllowedResourceActions[0]",
          "oldValue": null,
          "newValue": "Microsoft.Intune_MobileApps_Read"
        }
      ]
    }
  ]
}

Delete RoleDefinition

#

Description

Delete role definition

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "00e1871f-ea17-4ac6-bf36-c83b4bdc618b",
  "displayName": "Delete role definition",
  "componentName": "RoleBasedAccessControl",
  "activity": null,
  "activityDateTime": "2026-07-04T16:16:11.3213212Z",
  "activityType": "Delete RoleDefinition",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "bcd1ea5b-c085-490b-b76a-390165a01e7d",
  "category": "Role",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-f61e6487",
      "auditResourceType": "DeviceAndAppManagementRoleDefinition",
      "resourceId": "da32056b-f3e2-430c-9aa8-ba25fbc1d68d",
      "modifiedProperties": [
        {
          "displayName": "resourcePermissions",
          "oldValue": null,
          "newValue": "Microsoft.Intune/MobileApps/Read"
        },
        {
          "displayName": "description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "AssignedToUserWhoMadeChange",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "Id",
          "oldValue": "da32056b-f3e2-430c-9aa8-ba25fbc1d68d",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "detection.wiki intune harness",
          "newValue": "<null>"
        },
        {
          "displayName": "IsBuiltIn",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "2017-11-17"
        },
        {
          "displayName": "$Collection.RolePermissions.ResourceActions.AllowedResourceActions[0]",
          "oldValue": null,
          "newValue": "<null>"
        },
        {
          "displayName": "$Collection.RolePermissions.ResourceActions.AllowedResourceActions[1]",
          "oldValue": "Microsoft.Intune_MobileApps_Read",
          "newValue": null
        }
      ]
    }
  ]
}

Create RoleScopeTag

#

Description

Create Role Scope Tag

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "a9425026-de83-4f2c-a8c3-bb7892d7fb48",
  "displayName": "Create Role Scope Tag",
  "componentName": "RoleBasedAccessControl",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:05.0922221Z",
  "activityType": "Create RoleScopeTag",
  "activityOperationType": "Create",
  "activityResult": "Success",
  "correlationId": "5bfb5c0d-c644-47b2-ba59-a8c698b3ceab",
  "category": "Role",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "RoleScopeTag",
      "resourceId": "2",
      "modifiedProperties": [
        {
          "displayName": "description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "Id",
          "oldValue": null,
          "newValue": "2"
        },
        {
          "displayName": "Description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "IsBuiltIn",
          "oldValue": null,
          "newValue": "False"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-05-21"
        }
      ]
    }
  ]
}

Delete RoleScopeTag

#

Description

Delete Role Scope Tag

Fields #

NameDescription
activity Edm.StringFriendly name of the activity.
activityDateTime Edm.DateTimeOffsetThe date time in UTC when the activity was performed.
activityOperationType Edm.StringThe HTTP operation type of the activity.
activityResult Edm.StringThe result of the activity.
activityType Edm.StringThe type of activity that was being performed.
actor graph.auditActorAAD user and application that are associated with the audit event.
category Edm.StringAudit category.
componentName Edm.StringComponent name.
correlationId Edm.GuidThe client request Id that is used to correlate activity within the system.
displayName Edm.StringEvent display name.
resources Collection(graph.auditResource)Resources being modified.

Example Audit Record #

{
  "id": "d13d3a5d-f925-451f-a652-0eeb43e4f746",
  "displayName": "Delete Role Scope Tag",
  "componentName": "RoleBasedAccessControl",
  "activity": null,
  "activityDateTime": "2026-07-04T18:25:05.7106206Z",
  "activityType": "Delete RoleScopeTag",
  "activityOperationType": "Delete",
  "activityResult": "Success",
  "correlationId": "50cf4d27-423d-46a7-80b0-3343dc1ba43d",
  "category": "Role",
  "actor": {
    "auditActorType": "ItPro",
    "userPermissions": [
      "*"
    ],
    "applicationId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
    "applicationDisplayName": "Microsoft Graph Command Line Tools",
    "userPrincipalName": "adminuser@example.onmicrosoft.com",
    "servicePrincipalName": null,
    "ipAddress": null,
    "userId": "33333333-3333-3333-3333-333333333333"
  },
  "resources": [
    {
      "displayName": "dwharn-a9779b97",
      "auditResourceType": "RoleScopeTag",
      "resourceId": "2",
      "modifiedProperties": [
        {
          "displayName": "description",
          "oldValue": null,
          "newValue": "detection.wiki intune harness"
        },
        {
          "displayName": "Id",
          "oldValue": "2",
          "newValue": "<null>"
        },
        {
          "displayName": "Description",
          "oldValue": "detection.wiki intune harness",
          "newValue": "<null>"
        },
        {
          "displayName": "IsBuiltIn",
          "oldValue": "False",
          "newValue": "<null>"
        },
        {
          "displayName": "DeviceManagementAPIVersion",
          "oldValue": null,
          "newValue": "5026-05-21"
        }
      ]
    }
  ]
}

References #