review app registration audit log

Question

We had an app which was already added in our Entra ID directory. But somehow it was deleted . Can we find out why it was deleted or who deleted that App. Currently I restored the App.

Answer 1

Hello @Andy Dong,

To find out who deleted the application in your Microsoft Entra tenant, check the Entra Audit logs for the User Principal Name who performed the deletion.

Login into Azure Portal, navigate to Microsoft Entra ID >> Select Audit logs

You can filter the logs using:

• Audit Category: ApplicationManagement
• Activity: Delete application

Refer to the screenshot below for better understanding.

In the Audit log, you will find details such as:

• Who initiated the deletion
• When it happened (Timestamp)
• IP Address of the request

To view details about the deleted application, select Target(s) in the log.

For more information, refer to: Microsoft Entra Audit Activities

Ensure you select the last 30 days of audit logs.

Let me know if you're unable to find details about the User Principal Name (UPN) in the audit log and attach a screenshot of it.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hi Andy Dong,

Thanks for reaching out to Microsoft Q&A.

There can be below reasons that why Entra app was deleted:

1. Unused AAD/Entra ID applications in the Microsoft.com, AME, PME, GME, and Torus tenants will be soft-deleted starting March 2024. An unused application is an application that has had no usage activity for the prior 7 months.
2. if it is not correctly mapped- Entra ID App Registrations must map to a valid service within Service Tree
3. Might be deleted manually by an admin.

If this is deleted by someone, then you can check audit logs under Microsoft Entra admin center. Kindly follow this link for guidance - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.