Unable to see who has registered an Enterprise Application in Entra Id

Question

Hi folks,

I was trying to dig around Entra Id Audit Logs to determine who has registered a specific Enterprise Application.

While checking the Audit Logs, surprisingly enough I found the 'Initiated by (actor)' column blank. After googling it around I got another thread (link here) for the similar (or same) issue; however, it is not answered yet.

Could anyone please help me here. It appears to be a flaw in the Audit Logging of Entra because it may allow users to register apps anonymously?

PFB snippet of Audit Logs for reference:

Thanks in advance!

Cheers!

Answer 1

Hi @Apurva Pathak

Thank you for posting this in Microsoft Q&A.

I was able to reproduce the scenario in my environment, and I have noticed the same behavior. We consider this to be a known issue. I wanted to inform you that our PG team has investigated this issue and is working to resolve it.

Here is a detailed explanation of the issue:

When creating an application through app registration, we can see who registered the application under the "Initiated by" actor. However, when creating an application through the enterprise application blade, it does not capture who has created an Enterprise Application, as shown in the screenshot you shared.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

The text you've highlighted is just the "title" of the corresponding section, you can find the actual values below it - for example:

Of you can just get the details via the Graph API/PowerShell:

Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add service principal'" | select -First 1 | select -ExpandProperty InitiatedBy | select -ExpandProperty User


Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add service principal'" | select -First 1 | select -ExpandProperty InitiatedBy | select -ExpandProperty App