Microsoft Entra directory audit

Microsoft Entra directory audit. Directory audit events exported through Azure diagnostics.

Source and collection

Product audit API or configured diagnostic export.

Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 12b07c8ac149412a1c5f5d71e0a3c771e3536fec11e1d079f0b78c9ea5a3463e

{ "time": "2022-01-22T18:15:02.3875429Z", "resourceId": "/tenants/4bbb79f7-5724-4c9e-95f3-de075f6ec090/providers/Microsoft.aadiam", "operationName": "Update service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "4bbb79f7-5724-4c9e-95f3-de075f6ec090", "resultSignature": "None", "durationMs": "0", "callerIpAddress": "1.128.3.4", "correlationId": "87979703-118b-498f-99c2-ccd1a56f1a5a", "identity": "Managed Service Identity", "Level": 4, "properties": {"id":"Directory_87979703-118b-498f-99c2-ccd1a56f1a5a_ULAYA_144938566","category":"ApplicationManagement","correlationId":"87979703-118b-498f-99c2-ccd1a56f1a5a","result":"success","resultReason":"","activityDisplayName":"Update service principal","activityDateTime":"2022-01-22T18:15:02.3875429+00:00","loggedByService":"Core Directory","operationType":"Update","userAgent":null,"initiatedBy":{"app":{"appId":null,"displayName":"Managed Service Identity","servicePrincipalId":"b9814691-9ca1-4e55-a1ac-8ef5dd010ec0","servicePrincipalName":null}},"targetResources":[{"id":"a7d5dcbe-0627-4ddf-a2f4-86b6785bcc42","displayName":"billing-test-wus","type":"ServicePrincipal","modifiedProperties":[{"displayName":"TargetId.ServicePrincipalNames","oldValue":null,"newValue":"\"a70a7931-c387-4dce-9f35-fbf95bdcc91e;https://identity.azure.net/N8CUySpCeRFU3iB/PEuFlON4zd8+n8d3qgzrF1MviSY=\""}],"administrativeUnits":[]}],"additionalDetails":[{"key":"User-Agent","value":"Microsoft Azure Graph Client Library 2.1.17-internal"},{"key":"AppId","value":"a70a7931-c387-4dce-9f35-fbf95bdcc91e"}]}}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`time`	str
`resourceId`	str
`operationName`	str
`operationVersion`	str
`category`	str
`tenantId`	str
`resultSignature`	str
`durationMs`	str
`callerIpAddress`	str
`correlationId`	str
`identity`	str
`Level`	int
`properties.id`	str
`properties.category`	str
`properties.correlationId`	str
`properties.result`	str
`properties.resultReason`	str
`properties.activityDisplayName`	str
`properties.activityDateTime`	str
`properties.loggedByService`	str
`properties.operationType`	str
`properties.userAgent`	NoneType
`properties.initiatedBy.app.appId`	NoneType
`properties.initiatedBy.app.displayName`	str
`properties.initiatedBy.app.servicePrincipalId`	str
`properties.initiatedBy.app.servicePrincipalName`	NoneType
`properties.targetResources`	array
`properties.targetResources[0].id`	str
`properties.targetResources[0].displayName`	str
`properties.targetResources[0].type`	str
`properties.targetResources[0].modifiedProperties`	array
`properties.targetResources[0].modifiedProperties[0].displayName`	str
`properties.targetResources[0].modifiedProperties[0].oldValue`	NoneType
`properties.targetResources[0].modifiedProperties[0].newValue`	str
`properties.targetResources[0].administrativeUnits`	array
`properties.additionalDetails`	array
`properties.additionalDetails[0].key`	str
`properties.additionalDetails[0].value`	str

Event identity: Use the source event ID and tenant scope to deduplicate.
Event type: Select the schema for this category/action.
Timestamp: Retain both event and ingestion time where available.

Investigation uses

Review initiator, target resources and modified properties.
Compare actor and target context with approved changes and other authentication evidence.

Validation boundaries

An audit operation and a successful authentication are different event classes.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Learn about the monitoring and health activity log schemas - Microsoft Entra ID | Microsoft Learn

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.