How to Collect Azure AD Audit Logs | Directory Changes & Admin Actions

Step-by-step guide to ingesting Azure AD directory audit logs using Microsoft Graph API. Monitor admin actions, user management changes, application registrations, and group modifications.

  3 minute read  

Overview

Azure AD directory audit logs capture administrative actions and configuration changes in your Azure Active Directory. Use this guide to monitor user management operations, application registrations, group changes, role assignments, and policy modifications.

Common Use Cases:

  • Track user creation, deletion, and property changes
  • Monitor application registrations and permission grants
  • Audit group membership modifications
  • Review role assignments and privileged access changes
  • Detect unauthorized administrative actions

Prerequisites

Before configuring Edge Delta, complete the Azure AD application setup:

  1. Register an Azure AD application with Application permissions (not Delegated)
  2. Grant the AuditLog.Read.All permission and obtain admin consent
  3. Create a client secret and note your Tenant ID, Client ID, and Client Secret

For detailed setup instructions, see Microsoft Graph API Integration.

Configuration

Basic Directory Audit Collection

nodes:
- name: azure_ad_directory_audits
  type: http_pull_input
  endpoint: https://graph.microsoft.com/v1.0/auditLogs/directoryAudits
  method: GET
  pull_interval: 5m

  authorization:
    strategy: oauth_client_credentials
    client_credentials:
      token_url: https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token
      client_id: YOUR_CLIENT_ID
      client_secret: YOUR_CLIENT_SECRET
      scopes:
        - https://graph.microsoft.com/.default
      header_templates:
        - header: Authorization
          value: Bearer $ACCESS_TOKEN

  parameters:
    - name: "$orderby"
      value: "activityDateTime asc"
    - name: "$top"
      value: "50"

  parameter_expressions:
    - name: "$filter"
      value_expression: Concat(["activityDateTime ge ", FormatTime(Now() - Duration("5m10s"), "%Y-%m-%dT%H:%M:%SZ")], "")

Monitor User Management Actions

Filter for user-related administrative changes:

nodes:
- name: user_management_audits
  type: http_pull_input
  endpoint: https://graph.microsoft.com/v1.0/auditLogs/directoryAudits
  method: GET
  pull_interval: 5m

  authorization:
    strategy: oauth_client_credentials
    client_credentials:
      token_url: https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token
      client_id: YOUR_CLIENT_ID
      client_secret: YOUR_CLIENT_SECRET
      scopes:
        - https://graph.microsoft.com/.default
      header_templates:
        - header: Authorization
          value: Bearer $ACCESS_TOKEN

  parameters:
    - name: "$orderby"
      value: "activityDateTime asc"
    - name: "$top"
      value: "100"
    - name: "$filter"
      value: "category eq 'UserManagement'"

Monitor Application Changes

Track application registrations and permission changes:

nodes:
- name: application_audits
  type: http_pull_input
  endpoint: https://graph.microsoft.com/v1.0/auditLogs/directoryAudits
  method: GET
  pull_interval: 5m

  authorization:
    strategy: oauth_client_credentials
    client_credentials:
      token_url: https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token
      client_id: YOUR_CLIENT_ID
      client_secret: YOUR_CLIENT_SECRET
      scopes:
        - https://graph.microsoft.com/.default
      header_templates:
        - header: Authorization
          value: Bearer $ACCESS_TOKEN

  parameters:
    - name: "$orderby"
      value: "activityDateTime asc"
    - name: "$top"
      value: "50"
    - name: "$filter"
      value: "category eq 'ApplicationManagement'"

Audit Categories

Use these categories in the $filter parameter:

CategoryDescription
UserManagementUser creation, updates, deletions, password changes
GroupManagementGroup creation, membership changes, deletions
ApplicationManagementApp registrations, permissions, service principals
RoleManagementRole assignments, privileged access changes
DirectoryManagementTenant settings, domain management
PolicyConditional access, authentication policies

OData Filter Examples

FilterDescription
category eq 'UserManagement'User-related changes only
activityDisplayName eq 'Add user'Specific operation
result eq 'success'Successful operations only
result eq 'failure'Failed operations only
initiatedBy/user/userPrincipalName eq 'admin@company.com'Actions by specific admin

Combine multiple conditions:

$filter: "category eq 'UserManagement' and result eq 'success' and activityDateTime ge 2024-01-01T00:00:00Z"

Sample Directory Audit Log

{
  "id": "Directory_ABCD1234_20240101_001",
  "category": "UserManagement",
  "activityDateTime": "2024-01-01T10:00:00Z",
  "activityDisplayName": "Add user",
  "operationType": "Add",
  "result": "success",
  "resultReason": "User successfully created",
  "initiatedBy": {
    "user": {
      "userPrincipalName": "admin@company.com",
      "displayName": "Admin User",
      "id": "user-guid-here"
    }
  },
  "targetResources": [
    {
      "displayName": "john.doe@company.com",
      "type": "User",
      "userPrincipalName": "john.doe@company.com",
      "id": "new-user-guid"
    }
  ],
  "additionalDetails": [
    {
      "key": "UserType",
      "value": "Member"
    }
  ]
}

Key Fields for Analysis

FieldDescriptionUse Case
categoryType of resource affectedFilter by resource type
activityDisplayNameHuman-readable operation nameIdentify specific actions
resultsuccess or failureDetect failed admin operations
initiatedBy.userWho performed the actionTrack admin activity
targetResourcesWhat was affectedIdentify impacted objects

High-Value Operations to Monitor

These operations often indicate security-relevant changes:

OperationRisk LevelDescription
Add member to roleHighPrivileged access granted
Add owner to applicationHighApp ownership changed
Consent to applicationMediumPermission grant
Reset user passwordMediumCredential change
Delete userMediumAccount removal
Update applicationLowApp configuration change

Troubleshooting

IssueSolution
401 UnauthorizedVerify tenant ID, client ID, and secret are correct
403 ForbiddenEnsure AuditLog.Read.All permission has admin consent
Empty resultsDirectory audits may have 2-15 minute processing delay
Missing categoriesSome categories require specific Azure AD licenses