Azure AD Audit Logs custom fields

Question

I am trying to use the UserManagement Audit Logs to track changes to users. Is there a way to track changes to on-premises extension attributes or even extensionProperties? When I change these properties for a user, I can see a record create in the audit log but it isn't tracking the modified properties. Thank you.

Answer 1

Hi @Jessica Reichert ,

There is currently no blade to display extension properties or on-premises extension attributes. You have to use the Microsoft Graph API in order to see them. https://learn.microsoft.com/en-us/powershell/azure/active-directory/using-extension-attributes-sample?view=azureadps-2.0

To see the updates you would need to query those attributes directly:

Select-MgProfile -Name "beta",
(Get-MgUser -UserId "[UserObjectID]").OnPremisesExtensionAttributes

https://learn.microsoft.com/en-us/powershell/azure/active-directory/using-extension-attributes-sample?view=azureadps-2.0

If you're interested in this feature, I suggest filing this as feedback in the Azure AD feedback forum here : https://feedback.azure.com/

I would also be happy to surface this concern if you have a business justification you can provide.

Additional references:

Export all users to a CSV file with all OnPremisesExtensionAttributes

Let me know if this helps address your question and if you have further questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar information.