Azure Security Evidence Tables

Tables

AzureADAuditLogSignIns

Records Azure Active Directory sign-in audit events, including user identity, application accessed, device details, conditional access policy results, and risk information.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the sign-in event as provided by Azure Active Directory.
CreatedDateTime	datetime	Timestamp indicating when the sign-in event occurred.
UserDisplayName	string	Display name of the user who attempted the sign-in.
UserPrincipalName	string	User principal name (UPN), typically the user’s login email address.
UserId	string	Unique identifier of the user in Azure Active Directory.
AppId	string	Unique identifier of the application the user attempted to access.
AppDisplayName	string	Display name of the application involved in the sign-in event.
IpAddress	string	IP address from which the sign-in attempt originated.
ClientAppUsed	string	Client application used during the sign-in (e.g., `browser`, `mobile app`, `legacy client`).
CorrelationId	string	Identifier used to correlate related sign-in and authentication events.
ConditionalAccessStatus	string	Result of conditional access policy evaluation for the sign-in (e.g., `success`, `failure`).
IsInteractive	boolean	Indicates whether the sign-in was interactive (user-driven) or non-interactive.
RiskDetail	string	Detailed information about the detected risk associated with the sign-in.
RiskLevelAggregated	string	Overall aggregated risk level assigned to the sign-in event.
RiskLevelDuringSignIn	string	Risk level assessed in real time during the sign-in attempt.
RiskState	string	Current state of the risk (e.g., `none`, `atRisk`, `confirmedCompromised`).
RiskEventTypes	string	Types of risk events detected (e.g., `unfamiliar location`, `impossible travel`).
ResourceDisplayName	string	Display name of the resource or service the user attempted to access.
ResourceId	string	Unique identifier of the target resource or service.
Status	string	Outcome of the sign-in attempt, including success or failure details.
DeviceDetail	string	Information about the device used during the sign-in (e.g., `OS`, `browser`, `compliance`).
Location	string	Geographic location details associated with the sign-in attempt.
AppliedConditionalAccessPolicies	string	List of conditional access policies evaluated and applied during the sign-in.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADAdministrativeUnits

Stores Azure AD administrative unit definitions, including display name, description, membership type, dynamic membership rules, and visibility settings.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the administrative unit in Azure Active Directory.
DeletedDateTime	datetime	Timestamp indicating when the administrative unit was deleted`,` if applicable.
DisplayName	string	Display name of the administrative unit.
Description	string	Description providing additional details about the administrative unit.
IsMemberManagementRestricted	boolean	Indicates whether member management is restricted to specific administrators.
MembershipRule	string	Rule defining dynamic membership criteria for the administrative unit.
MembershipType	string	Type of membership for the administrative unit (e.g., `assigned`, `dynamic`).
MembershipRuleProcessingState	string	Current processing state of the membership rule (e.g., `on`, `paused`, `processing`).
Visibility	string	Visibility setting of the administrative unit (e.g., `public`, `hidden`).
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADAuthorizationPolicy

Contains the Azure AD tenant-wide authorization policy settings, controlling user consent permissions, guest access, SSPR eligibility, and default user role permissions.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the authorization policy in Azure Active Directory.
AllowInvitesFrom	string	Specifies which users are allowed to send invitations to external users (e.g., `admins`, `users`, `none`).
AllowedToSignUpEmailBasedSubscriptions	boolean	Indicates whether users can sign up for email-based subscriptions or services.
AllowedToUseSSPR	boolean	Indicates whether users are allowed to use self-service password reset (SSPR).
AllowEmailVerifiedUsersToJoinOrganization	boolean	Indicates whether users with verified email domains can join the organization.
AllowUserConsentForRiskyApps	boolean	Indicates whether users can grant consent to applications that may be considered risky.
BlockMsolPowerShell	boolean	Indicates whether legacy MSOL PowerShell access is blocked.
DisplayName	string	Display name of the authorization policy.
Description	string	Description providing additional details about the authorization policy.
GuestUserRoleId	string	Identifier of the role assigned to guest users in the directory.
DefaultUserRolePermissions	string	Permissions assigned to default users within the organization.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADDeletedApplications

Records Azure AD applications that have been soft-deleted, including full application configuration metadata, API settings, credentials, policies, and certification details.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the deleted Azure AD application.
DeletedDateTime	datetime	Timestamp indicating when the application was deleted.
ApplicationTemplateId	string	Identifier of the application template used to create the application, if applicable.
DisabledByMicrosoftStatus	string	Status indicating whether the application was disabled by Microsoft due to risk or policy.
CreatedByAppId	string	Identifier of the application or service that created this application.
CreatedDateTime	datetime	Timestamp indicating when the application was originally created.
DisplayName	string	Display name of the application.
Description	string	Description providing additional details about the application.
GroupMembershipClaims	string	Configuration specifying group claims included in tokens.
IdentifierUris	string	List of URIs used to identify the application within Azure AD.
IsDeviceOnlyAuthSupported	boolean	Indicates whether the application supports device-only authentication.
IsFallbackPublicClient	boolean	Indicates whether the application is treated as a public client fallback.
Notes	string	Additional notes or comments associated with the application.
PublisherDomain	string	Verified domain of the application publisher.
ServiceManagementReference	string	Reference used for service management or internal tracking.
SignInAudience	string	Specifies the audience allowed to sign in (e.g., `single-tenant`, `multi-tenant`).
Tags	string	List of tags assigned to the application for categorization.
TokenEncryptionKeyId	string	Identifier of the key used for token encryption.
UniqueName	string	Unique name assigned to the application.
SamlMetadataUrl	string	URL to the SAML metadata document for the application.
DefaultRedirectUri	string	Default redirect URI used in authentication flows.
AddInsJson	string	JSON representation of add-in configurations associated with the application.
ApiJson	string	JSON configuration describing exposed APIs and permissions.
InfoJson	string	JSON metadata containing informational properties of the application.
OptionalClaimsJson	string	JSON configuration of optional claims included in tokens.
ParentalControlSettingsJson	string	JSON configuration for parental control or age-based access settings.
PublicClientJson	string	JSON configuration for public client application settings.
RequiredResourceAccessJson	string	JSON list of required API permissions and resource access definitions.
VerifiedPublisherJson	string	JSON details about the verified publisher of the application.
WebJson	string	JSON configuration for web application settings (redirect URIs, etc.).
SpaJson	string	JSON configuration for single-page application (SPA) settings.
AdditionalData	string	Additional unstructured data returned by the API not mapped to specific fields.
SynchronizationJson	string	JSON configuration for synchronization settings.
TokenIssuancePoliciesJson	string	JSON list of token issuance policies applied to the application.
TokenLifetimePoliciesJson	string	JSON list of token lifetime policies applied to the application.
AppManagementPoliciesJson	string	JSON configuration of application management policies.
AuthenticationBehaviorsJson	string	JSON configuration describing authentication behavior settings.
CreatedOnBehalfOfJson	string	JSON details indicating if the application was created on behalf of another entity.
DisabledByMicrosoftStatusJson	string	JSON details explaining Microsoft-enforced disablement status.
ExtensionProperties	string	Custom extension properties defined for the application.
FederatedIdentityCredentials	string	JSON list of federated identity credentials associated with the application.
HomeRealmDiscoveryPolicies	string	JSON list of home realm discovery policies applied to the application.
NativeAuthenticationApisEnabledJson	string	JSON configuration indicating enabled native authentication APIs.
Oauth2RequirePostResponse	boolean	Indicates whether OAuth2 authorization responses must use HTTP POST.
OdataType	string	OData type identifier for the application object.
CertificationDetailsUrl	string	URL containing certification details for the application.
CertificationExpirationDateTime	datetime	Timestamp when the application certification expires.
CertificationIsCertifiedByMicrosoft	boolean	Indicates whether the application is Microsoft-certified.
CertificationIsPublisherAttested	boolean	Indicates whether certification is publisher-attested.
CertificationLastCertificationDateTime	datetime	Timestamp of the last certification event.
RequestSignatureVerificationAllowedWeakAlgorithms	string	List of weak algorithms allowed for request signature verification, if any.
RequestSignatureVerificationIsSignedRequestRequired	boolean	Indicates whether signed requests are required.
ServicePrincipalLockConfigurationAllProperties	boolean	Indicates whether all service principal properties are locked.
ServicePrincipalLockConfigurationCredentialsWithUsageSign	boolean	Indicates whether signing credentials are locked.
ServicePrincipalLockConfigurationCredentialsWithUsageVerify	boolean	Indicates whether verification credentials are locked.
ServicePrincipalLockConfigurationIsEnabled	boolean	Indicates whether service principal lock configuration is enabled.
ServicePrincipalLockConfigurationTokenEncryptionKeyId	boolean	Indicates whether the token encryption key is locked.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADDeletedApplicationOwners

Stores owner records associated with soft-deleted Azure AD applications, including owner identity, contact information, and job details.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the owner (user or service principal).
AzureADDeletedApplicationID	string	Unique identifier of the deleted Azure AD application associated with the owner.
DisplayName	string	Display name of the application owner.
AzureADDeletedApplicationConfigID	integer	Identifier linking to the specific configuration record of the deleted application.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.
BusinessPhones	string	List of business phone numbers associated with the owner.
GivenName	string	Given (first) name of the owner.
JobTitle	string	Job title of the owner within the organization.
Mail	string	Primary email address of the owner.
MobilePhone	string	Mobile phone number of the owner.
OfficeLocation	string	Office location of the owner.
PreferredLanguage	string	Preferred language of the owner.
Surname	string	Surname (last name) of the owner.
UserPrincipalName	string	User principal name (UPN) of the owner, typically their login email.

AzureADDeletedApplicationPasswordCredentials

Contains password credential records associated with soft-deleted Azure AD applications, including credential display name, validity period, and hint.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the password credential associated with the deleted application.
AzureADDeletedApplicationID	string	Unique identifier of the deleted Azure AD application to which the credential belonged.
DisplayName	string	Display name assigned to the password credential.
EndDateTime	datetime	Timestamp indicating when the password credential expires or expired.
Hint	string	Non-sensitive hint or identifier used to help recognize the credential.
SecretText	string	Secret value associated with the credential at the time of creation or ingestion.
StartDateTime	datetime	Timestamp indicating when the password credential became valid.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADDeletedApplicationRoles

Records application role definitions associated with soft-deleted Azure AD applications, including role name, description, allowed member types, and enabled status.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the application role.
AzureADDeletedApplicationID	string	Unique identifier of the deleted Azure AD application to which the role belonged.
AllowedMemberTypesList	string	List of principal types that can be assigned to the role (e.g., `users`, `applications`).
Description	string	Description providing details about the purpose and permissions of the role.
DisplayName	string	Display name of the application role.
IsEnabled	boolean	Indicates whether the role is enabled and available for assignment.
Origin	string	Specifies the origin of the role definition (e.g., `application`, `system`).
Value	string	Value of the role used in tokens and application authorization logic.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADDeletedGroups

Stores Azure AD groups that have been soft-deleted, capturing group identity, display name, and deletion timestamp.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the deleted Azure AD group.
DisplayName	string	Display name of the group at the time of deletion.
DeletedDateTime	datetime	Timestamp indicating when the group was deleted.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADDirectoryAudits

Contains Azure AD directory audit log events, capturing administrative operations such as user management, group changes, and application updates with initiator and target resource details.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the directory audit event.
Category	string	Category of the audit event (e.g., `user management`, `group management`, `application`).
ActivityDisplayName	string	Human-readable name describing the audited activity.
ActivityDateTime	datetime	Timestamp indicating when the audited activity occurred.
LoggedByService	string	Service that generated the audit log (e.g., `Azure AD`, `Identity Protection`).
OperationType	string	Type of operation performed (e.g., `add`, `update`, `delete`).
Result	string	Result of the operation (e.g., `success`, `failure`).
ResultReason	string	Additional details explaining the result of the operation, if available.
CorrelationId	string	Identifier used to correlate related audit events across services.
InitiatedBy	string	Information about the user or service principal that initiated the action (JSON or structured data).
TargetResources	string	List of resources affected by the operation (JSON or structured data).
AdditionalDetails	string	Additional key-value details related to the audit event (JSON format).
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADIdentityProtectionRiskDetections

Records individual risk detection events from Azure AD Identity Protection, including risk type, level, state, associated user, IP address, and detection timing.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the risk detection event.
RiskType	string	Type of risk detected (e.g., `impossibleTravel`, `anonymizedIPAddress`).
RiskLevel	string	Severity level of the detected risk (e.g., `low`, `medium`, `high`).
RiskState	string	Current state of the risk (e.g., `active`, `remediated`, `dismissed`).
DetectionTimingType	string	Indicates when the risk was detected (e.g., `real-time`, `offline`).
Activity	string	Type of activity associated with the risk detection (e.g., `sign-in`, `user activity`).
TokenIssuerType	string	Type of token issuer involved in the event (e.g., `Azure AD`, `ADFS`).
UserId	string	Unique identifier of the user associated with the risk event.
UserDisplayName	string	Display name of the user associated with the risk event.
UserPrincipalName	string	User principal name (UPN), typically the user’s login email address.
IpAddress	string	IP address associated with the risk event.
Location	string	Geographic location details associated with the risk event (JSON or structured data).
ActivityDateTime	datetime	Timestamp indicating when the risky activity occurred.
DetectionDateTime	datetime	Timestamp indicating when the risk was detected by the system.
AdditionalInfo	string	Additional contextual details about the risk event (JSON or key-value format).
Source	string	Source system or detection mechanism that generated the risk event.
RequestId	string	Identifier of the request associated with the risk event.
CorrelationId	string	Identifier used to correlate this event with related activities.
ServicePrincipalId	string	Unique identifier of the service principal involved in the event, if applicable.
ServicePrincipalName	string	Display name of the service principal involved in the event, if applicable.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADIdentityProtectionRiskyUsers

Stores risky user records from Azure AD Identity Protection, capturing aggregated risk level, state, risk detail, and historical risk state changes per user.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the risky user record.
RiskLastUpdatedDateTime	datetimeoffset	Timestamp indicating when the user’s risk state was last updated.
RiskLevel	string	Aggregated risk level assigned to the user (e.g., `low`, `medium`, `high`).
RiskState	string	Current state of the user risk (e.g., `atRisk`, `remediated`, `dismissed`).
RiskDetail	string	Detailed classification or reason associated with the user’s risk.
UserPrincipalName	string	User principal name (UPN), typically the user’s login email address.
UserDisplayName	string	Display name of the user.
UserId	string	Unique identifier of the user in Azure Active Directory.
RiskTypes	string	List of risk event types associated with the user (e.g., `leakedCredentials`, `impossibleTravel`).
IsDeleted	boolean	Indicates whether the user account has been deleted.
IsProcessing	boolean	Indicates whether the user’s risk state is currently being evaluated or updated.
History	string	Historical record of risk state changes and related events (JSON or structured data).
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADIdentitySecurityDefaultsEnforcementPolicies

Contains the Azure AD security defaults enforcement policy configuration, indicating whether baseline security protections are enabled for the tenant.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the security defaults enforcement policy.
Description	string	Description providing details about the security defaults policy and its purpose.
DisplayName	string	Display name of the security defaults enforcement policy.
IsEnabled	boolean	Indicates whether Azure AD security defaults are enabled and enforced.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.

AzureADSecurityAlerts

Stores Microsoft security alerts surfaced through Azure AD and Microsoft 365 Defender, including severity, classification, MITRE techniques, evidence, and remediation recommendations.

Name	Type	Description
ConfigID	integer	Identifier linking the record to a specific Azure AD configuration or integration setup.
ID	string	Unique identifier of the security alert.
ProviderAlertId	string	Identifier assigned by the originating security provider for the alert.
IncidentId	string	Identifier of the incident grouping one or more related alerts.
Status	string	Current status of the alert (e.g., `active`, `resolved`, `inProgress`).
Severity	string	Severity level of the alert (e.g., `low`, `medium`, `high`, `critical`).
Classification	string	Classification of the alert after investigation (e.g., `truePositive`, `falsePositive`).
Determination	string	Determination outcome providing additional context (e.g., `malicious`, `benign`).
ServiceSource	string	Service that generated the alert (e.g., Azure AD Identity Protection).
DetectionSource	string	Source or mechanism used to detect the threat (e.g., `analytics`, `heuristics`).
ProductName	string	Product or security solution that generated the alert.
DetectorId	string	Identifier of the detection logic or rule that triggered the alert.
TenantId	string	Identifier of the Azure AD tenant where the alert originated.
Title	string	Short title summarizing the security alert.
Description	string	Detailed description of the alert and associated threat activity.
RecommendedActions	string	Suggested remediation or response actions for the alert.
Category	string	Category of the alert (e.g., `credentialAccess`, `privilegeEscalation`).
AssignedTo	string	User or team assigned to investigate or remediate the alert.
AlertWebUrl	string	URL linking to the alert details in the security portal.
IncidentWebUrl	string	URL linking to the associated incident in the security portal.
ActorDisplayName	string	Display name of the actor associated with the alert (user or service).
ThreatDisplayName	string	Name of the detected threat or attack technique.
ThreatFamilyName	string	Threat family classification (e.g., malware family or attack group).
MitreTechniques	string	List of MITRE ATT&CK techniques associated with the alert.
CreatedDateTime	datetime	Timestamp indicating when the alert was created.
LastUpdateDateTime	datetime	Timestamp indicating when the alert was last updated.
ResolvedDateTime	datetime	Timestamp indicating when the alert was resolved, if applicable.
FirstActivityDateTime	datetime	Timestamp of the first observed activity related to the alert.
LastActivityDateTime	datetime	Timestamp of the most recent activity related to the alert.
Comments	string	Investigation notes or comments associated with the alert.
Evidence	string	Supporting evidence related to the alert (JSON or structured data).
SystemTags	string	System-generated tags used for categorization and automation.
AdditionalData	string	Additional unstructured data or metadata returned by the API.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed.