Share via

Azure AD Audit logs - Not showing teh User who made the changes

Malli Boppe 31 Reputation points
2021-08-03T07:49:16.403+00:00

Was investigating on AD group membership changes. Checked the AD audit logs and found that events related to group membership changes, but doesn't show the account which made the changes. It says that the changes was intiated by an application called Microsoft Substrate Management and not the actual Username.

Can any one point me to right direction on how to findout the group memebrship changes.

Initiated by (actor)
Type
Application
Display Name
Microsoft Substrate Management

We use sentinel and would be nice to setup an alert

Microsoft Security | Microsoft Sentinel

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee
    2021-08-03T08:05:03.147+00:00

    @Malli Boppe Microsoft Substrate Management” is a service principal used by Exchange Online during dual-writing operations to AAD. These audit log entries refer to create/update/delete operations executed by EXO to AAD. These entries are informational in nature do not require any action and there is no user as this is a service which is doing it, this can be ignored.

    The event that you see is because of a Dual-write concept which gets enabled on every tenant from Service Side. Normally when you create or modify user’s properties via Exchange Admin Center (EAC), Exchange Online PowerShell or other API, the change replicates to Azure Active Directory (AAD) through a sync mechanism which can take some time to complete. Simply put, you might not see the result of your change in AAD for a while due to this back-sync process.

    In Dual -write state, when you make user object changes in Exchange the changes will now be dual-written to AAD and EXO. The end result is that the replication of those properties should be close to immediate and changes made in EXO will immediately reflect in AAD when the cmdlet completes successfully.

    As part of dual-write operations, you will see audit log entries with actions taken by “Microsoft Substrate Management”.

    Even if the admin uses Microsoft office admin portal for any group membership activity, the actions are captured in Azure AD Audit logs. For example, an addition in group by adding a member user is reflect in Azure AD audit logs like this :

    120316-image.png

    If you track the same event in Azure sentinel, it does give you who initiated the request/changes. :

    120288-image.png

    If you expand that, you will see the initiated actor :

    120279-image.png

    -----------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.