The Microsoft Entra ID audit log records directory operations and administrative activity across an Azure tenant. It helps investigate lateral movement and privilege escalation, such as unauthorized password resets or additions to administrator groups. section 9.1.1
Audit records commonly answer questions about:
- Users: which operations affected users, who performed them, and how many passwords changed. section 9.1.1
- Groups: changes to ownership, membership, and newly added groups. section 9.1.1
- Applications: newly added or changed applications, consent grants, and service-principal changes. section 9.1.1
Table 9.1 Questions that can be answered by each log category in Microsoft Entra ID audit logs (view table figure)
Use the question-to-category table to choose the relevant audit-log records during directory investigations. section 9.1.1
