What does the RequestType column mean in M365 logs (Unified Audit Log)?

Question

Hi,

do you know what this RequestType column in the Unified Audit Log (UAL) means?

I think it's related to the type of Microsoft Entra authentication requested by an endpoint (e.g. MFA request and Keep Me Signed In prompt).

Typical values are:
Cmsi:Cmsi
Consent:Set
Kmsi:kmsi
Login:login
Login:reprocess
Login:resume
OAuth2:Authorize
OAuth2:Token
PermitSso:PermitSso
Saml2:processrequest
SAS:BeginAuth
SAS:EndAuth
SAS:ProcessAuth
SSPR:end
WindowsAuthenticationControllerusernamemixed
WindowsAuthewnticationControllerwindowstransport
WsFederation:wsfederation

It seems that RequestType is named "EndpointCall" (AADSignInEventsBeta table) for Microsoft Defender XDR.

Is there any (official) documentation?

It is very hard to do advanced hunting or anomaly detection in the UnifiedAuditLog (UAL) without any knowledge about the meaning of these values of the RequestType column. Possibly already available since July 2022, but still no helpful information found in the web. Thanks a lot for your help!

Answer 1

Dear Martin Willing  Thanks for using Microsoft products and posting in the community.I wish I could solve your problem, but Microsoft Entra ID issues may require support in a specific area of expertise. You might consider consulting with Microsoft Q&A | Microsoft Learn (English only), where experts may have a better understanding of how to solve your problem.Here is a link to the Microsoft Entra ID - Microsoft Q&A (English only)， where you can suggest specific scenarios and share ideas on how to solve the problem.I sincerely hope that your query was handled appropriately after you contacted the appropriate department. Thank you for your understanding!Best Regards,Maxine | Microsoft Community Support Specialist