Microsoft 365, Entra ID & Azure telemetry sources
Microsoft 365 Unified Audit Log
Each RecordType (a published AuditLogRecordType enum member, both a name and a numeric ID) is modeled as an M365-<RecordType> provider, grouped under its Workload. Each Operation within it is an event.
Corpus-demand-gated against the Sigma product:m365, Elastic o365.audit, and Sentinel OfficeActivity rule sets, plus a curated high-value seed. See the M365 coverage matrix for which rules cover which operations.
Microsoft Entra ID directory audit
Entra ID has no numeric event IDs. The audit log's per-record discriminator is OperationName (= activityDisplayName). The single Microsoft Entra ID audit logs provider catalogs 87 operations, each modeled as an event. Sign-in telemetry has no per-operation discriminator (OperationName is always Sign-in activity), so it is covered by the coverage matrix rather than event pages.
Entra rules share the azure platform facet with the Azure resource plane. See the Azure AD coverage matrix for the dual AuditLogs / SigninLogs rule view, and the Entra ID sign-in telemetry reference for the sign-in side (no per-operation event pages).
Azure resource-plane (Activity log)
The Azure Activity log records ARM control-plane operations. Each operation embeds its resource-provider namespace (e.g. Microsoft.Compute/virtualMachines/write), so the catalog models each namespace as an Azure-<namespace> provider and each ARM operationName as an event.
| Resource provider | Namespace | Operations |
|---|---|---|
| Azure AD Hybrid Health Service | Microsoft.ADHybridHealthService | 2 |
| Azure Authorization | Microsoft.Authorization | 2 |
| Azure Automation | Microsoft.Automation | 7 |
| Azure Compute | Microsoft.Compute | 6 |
| Azure Container Registry | Microsoft.ContainerRegistry | 2 |
| Azure Event Hubs | Microsoft.EventHub | 2 |
| Azure Monitor | Microsoft.Insights | 1 |
| Azure Key Vault | Microsoft.KeyVault | 21 |
| Azure Arc Kubernetes | Microsoft.Kubernetes | 28 |
| Azure Machine Learning | Microsoft.MachineLearningServices | 0 |
| Azure Network | Microsoft.Network | 47 |
| Azure Portal | Microsoft.Portal | 1 |
| Azure Resource Manager | Microsoft.Resources | 3 |
| Microsoft Defender for Cloud | Microsoft.Security | 1 |
| Azure Storage | Microsoft.Storage | 7 |
| Azure Subscription | Microsoft.Subscription | 1 |
Corpus-demand-gated against the Sigma azure.activitylogs and Sentinel AzureActivity rule sets. The catalog stores each operation in its standard ARM spelling. Sentinel writes the same operation in all caps under OperationNameValue, but the two still match because the comparison ignores case.
Why M365 and Entra ID stay separate
The M365 Unified Audit Log AzureActiveDirectory RecordType and the Entra ID AuditLogs table both record directory activity, but they are distinct pipelines with different schemas and non-identical coverage (the UAL captures only the directory changes that affect M365 services, while Entra AuditLogs is the comprehensive record). Rules pick one pipeline, so each attributes to its own provider. The same operation can even differ by literal: the UAL writes Add member to role. (trailing period) where Entra writes Add member to role.