Microsoft-Windows-TenantRestrictions

13 events across 1 channel

Event	Title	Channel	Sample
1001	The networking component failed to load in a process due to an error in the …	Operational	N
1002	An attempt to start the tenant restrictions sync service (cloudidsvc) failed.	Operational	N
1003	A request was processed that already contained the …	Operational	N
1004	The endpoint sync service (cloudidsvc) started succesfully.	Operational	N
1005	The endpoint sync service (cloudidsvc) succesfully synced the latest list of …	Operational	N
1006	The networking component failed to process a network request.	Operational	N
1007	The endpoint sync service (cloudidsvc) has failed to sync its endpoints for a …	Operational	N
1008	The networking component failed to process a policy change.	Operational	N
1009	The networking component failed subscribe to policy changes.	Operational	N
1010	The networking component failed to read the policy in a process due to an error …	Operational	N
1011	The entered tenantid or policy id is an invalid guid.	Operational	N
1012	The response from O365 server returned an empty response preventing an endpoint …	Operational	N
1013	The endpoint sync service (cloudidsvc) has failed to reach the O365 server, …	Operational	N

Event ID 1001: The networking component failed to load in a process due to an error in the module below.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

The networking component failed to load in a process due to an error in the module below. Requests from this process won't get tenant restriction headers applied. Please restart this executable or reboot to reload the networking component. Networking stack: NetworkingStack Executable name: ImageName Module: ModuleName Error: ErrorCode

Message #

The networking component failed to load in a process due to an error in the module below. Requests from this process won't get tenant restriction headers applied. Please restart this executable or reboot to reload the networking component. 



Networking stack: %1

Executable name: %2

Module: %3

Error: %4

Fields #

Name	Description
`NetworkingStack` AnsiString
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1002: An attempt to start the tenant restrictions sync service (cloudidsvc) failed.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

An attempt to start the tenant restrictions sync service (cloudidsvc) failed. If cloudidsvc is not running it is possible that tenant restrictions will apply to a stale list of endpoints. Please restart the the tenant restrictions sync service (cloudidsvc) to ensure that tenant restrictions is enforced on an up-to-date list of endpoints. Executable name: ImageName Module: ModuleName Error: ErrorCode

Message #

An attempt to start the tenant restrictions sync service (cloudidsvc) failed. If cloudidsvc is not running it is possible that tenant restrictions will apply to a stale list of endpoints. Please restart the the tenant restrictions sync service (cloudidsvc) to ensure that tenant restrictions is enforced on an up-to-date list of endpoints. 



Executable name: %1

Module: %2

Error: %3

Fields #

Name	Description
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1003: A request was processed that already contained the sec-restrict-tenant-access-policy header.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

A request was processed that already contained the sec-restrict-tenant-access-policy header. This may indicate an attempt to bypass tenant restrictions or a misconfigured app.

Message #

A request was processed that already contained the sec-restrict-tenant-access-policy header. This may indicate an attempt to bypass tenant restrictions or a misconfigured app.



This pre-existing value was overwritten:

%1



This value is configured by policy:

%2



Executable name: %3

Fields #

Name	Description
`ExistingHeader` UnicodeString
`ConfiguredHeader` UnicodeString
`ImageName` UnicodeString

Event ID 1004: The endpoint sync service (cloudidsvc) started succesfully.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The endpoint sync service (cloudidsvc) started succesfully.

Message #

The endpoint sync service (cloudidsvc) started succesfully.

Event ID 1005: The endpoint sync service (cloudidsvc) succesfully synced the latest list of endpoints.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The endpoint sync service (cloudidsvc) succesfully synced the latest list of endpoints.

Message #

The endpoint sync service (cloudidsvc) succesfully synced the latest list of endpoints.

Event ID 1006: The networking component failed to process a network request.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

The networking component failed to process a network request. The request was cancelled due to the failure. Further access to the network may be blocked for this application.

Message #

The networking component failed to process a network request. The request was cancelled due to the failure. Further access to the network may be blocked for this application.



Networking stack: %1

Executable name: %2

Module: %3

Error: %4

Fields #

Name	Description
`NetworkingStack` AnsiString
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1007: The endpoint sync service (cloudidsvc) has failed to sync its endpoints for a full 24 hours with the last successful sync at LastSuccessfulSync.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The endpoint sync service (cloudidsvc) has failed to sync its endpoints for a full 24 hours with the last successful sync at LastSuccessfulSync. This may be expected if the machine has not been connected to the network. It is possible that without a sync tenant restriction headers will not be applied to the correct endpoints. Ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762. Another attempt will be made in TimeInHours hours. The error code of the latest attempt is: ErrorCode

Message #

The endpoint sync service (cloudidsvc) has failed to sync its endpoints for a full 24 hours with the last successful sync at %1. This may be expected if the machine has not been connected to the network. It is possible that without a sync tenant restriction headers will not be applied to the correct endpoints. Ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762. Another attempt will be made in %2 hours.



The error code of the latest attempt is: %3

Fields #

Name	Description
`LastSuccessfulSync` UnicodeString
`TimeInHours` Int32
`ErrorCode` Int32

Event ID 1008: The networking component failed to process a policy change.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

The networking component failed to process a policy change. Please restart the affected executable(s) to ensure that the policy change is enforced.

Message #

The networking component failed to process a policy change. Please restart the affected executable(s) to ensure that the policy change is enforced.



Executable name: %1

Module: %2

Error: %3

Fields #

Name	Description
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1009: The networking component failed subscribe to policy changes.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

The networking component failed subscribe to policy changes. Please restart the affected executable(s) to ensure that the policy updates are correctly received.

Message #

The networking component failed subscribe to policy changes. Please restart the affected executable(s) to ensure that the policy updates are correctly received.



Executable name: %1

Module: %2

Error: %3

Fields #

Name	Description
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1010: The networking component failed to read the policy in a process due to an error in the module below.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: NetworkingPlugin

Description

The networking component failed to read the policy in a process due to an error in the module below. Requests from this process won't get tenant restriction headers applied until the policy is re-applied correctly. Executable name: ImageName Module: ModuleName Error: ErrorCode

Message #

The networking component failed to read the policy in a process due to an error in the module below. Requests from this process won't get tenant restriction headers applied until the policy is re-applied correctly.



Executable name: %1

Module: %2

Error: %3

Fields #

Name	Description
`ImageName` UnicodeString
`ModuleName` UnicodeString
`ErrorCode` Int32

Event ID 1011: The entered tenantid or policy id is an invalid guid.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The entered tenantid or policy id is an invalid guid. Please correct the incorrect guid(s) below to enable Tenant Restrictions.

Message #

The entered tenantid or policy id is an invalid guid. Please correct the incorrect guid(s) below to enable Tenant Restrictions.

%1

Fields #

Name	Description
`InvalidGuid` UnicodeString

Event ID 1012: The response from O365 server returned an empty response preventing an endpoint sync.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The response from O365 server returned an empty response preventing an endpoint sync. Please check your proxy/network settings and ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762.

Message #

The response from O365 server returned an empty response preventing an endpoint sync. Please check your proxy/network settings and ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762.

Event ID 1013: The endpoint sync service (cloudidsvc) has failed to reach the O365 server, preventing an endpoint sync.

Provider: Microsoft-Windows-TenantRestrictions
Channel: Operational
Task: SyncService

Description

The endpoint sync service (cloudidsvc) has failed to reach the O365 server, preventing an endpoint sync. Please check your proxy/network settings and ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762. The request path is: RequestPath The HTTP status code is: HttpErrorCode The request headers are: ResponseHeaders The networking error code is: NetworkingErrorCode

Message #

The endpoint sync service (cloudidsvc) has failed to reach the O365 server, preventing an endpoint sync. Please check your proxy/network settings and ensure that cloudidsvc has network connectivity as described at https://go.microsoft.com/fwlink/?linkid=2148762. 



The request path is: %1 



The HTTP status code is: %2 



The request headers are:

%3 



The networking error code is: %4

Fields #

Name	Description
`RequestPath` UnicodeString
`HttpErrorCode` Int32
`ResponseHeaders` UnicodeString
`NetworkingErrorCode` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 4053fada-178b-5aa8-746b-7cf8538b5118

Defined in cloudidsvc.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-TenantRestrictions registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)