Skip to content
Sign In
Telemetry

azure:auditlogs

Entra ID audit logs

Event keys are operation names

Host type
Azure (platform and Entra ID)
Tier, as a whole
Minimum
Cost class
Included
Techniques
12
Rules listed
218
Events
65

Why this tier

CISA-SCUBA-M365; CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis)

Licensing

License or service
Entra ID Free
What is free
Portal on Free; 7d Free / 30d P1-P2
What costs
Export: P1/P2 prerequisite + Azure Monitor ingestion
Notes
Retention table
Vendor page
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Identity usedSupports an activityour analysis: the initiating identity on every operation
OMB M-26-14: Privilege changesSupports an activityour analysis: role assignments
OMB M-26-14: Infrastructure changesSupports an activityour analysis: device registration
ASD ACSC / CISA et al.: Priority enterprise log sourcespriority_sourcequoted (cloud): logs for the creation, deletion and modification of all security principals, including setting and changing permissions
CISA SCuBA: Audit logging policiesnames_sourcequoted (6.3 note): retaining Microsoft Entra ID audit records for one year

Techniques

Rules

Splunk 40
Sigma 44
Elastic 36
Microsoft Sentinel 98

Events

Listed (45)

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.