Azure AD audit log of event "User registered security info"

Question

Hi Team,

Since 4th June 2026, in the azure audit logs of event "User registered security info" there is new reason recorded in the logs in field "resultReason" .

Is there any changes that has been made to audit logs by microsoft, related to MFA registration that may be leading to "resultReason" capturing the value "User registered security info"?

"result": "success",
    "activityDisplayName": "User registered security info",
    "resultReason": "User registered security info",
    "loggedByService": "Azure MFA",
    "operationType": "Update",

Answer 1

Hello Ravi Maurya,

There is no change in functionality, but what you are seeing is due to an update in how Microsoft Entra ID logs Authentication Methods / MFA registration events.

Earlier, for the activity“User registered security info”, the resultReason field was often empty or showed a generic value. Now, Microsoft has updated the logging so that resultReason is always populated with a clearer description of the outcome. In many cases, when there is no more granular detail (for example, method type), it will default to the same value as the activity name.

So in your case:

activityDisplayName = "User registered security info"
result = "success"
resultReason = "User registered security info"

This simply means the user successfully registered a security method, and the system is explicitly recording that in both fields.

As per Microsoft documentation, for combined registration:

• “User registered security info – Success” indicates that a user registered an authentication method https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot

The resultReason field is designed to describe the outcome of the operation and may contain a textual description of the action performed https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs

This is expected behavior due to improved audit log verbosity for MFA/SSPR registration events. It does not indicate any issue or tenant-side change.

Answer 2

Yes. Microsoft has expanded the Authentication Methods / combined registration auditing so that more detailed result reasons are recorded for MFA and security info events.

Previously, many “User registered security info” audit entries either had a generic or empty resultReason. The current behavior is that the Authentication Methods service (and Azure MFA) now logs a more explicit resultReason, including cases where it repeats the activity name, such as:

"activityDisplayName": "User registered security info",
"result": "success",
"resultReason": "User registered security info",
"loggedByService": "Azure MFA",
"operationType": "Update"

This aligns with the documented Authentication Methods / combined registration events, where:

• activityDisplayName identifies the action (for example, User registered security info, User registered all required security info, User changed default security info, User deleted security info).
• result indicates Success/Failure.
• resultReason provides a textual description of what happened (for example, User registered Fido2 Authentication Method, User registered temporary access pass method, or a generic description mirroring the activity).

The newer examples for Get-EntraAuditDirectoryLog and Get-EntraBetaAuditDirectoryLog show this pattern explicitly, where Authentication Methods audit entries include a populated ResultReason describing the registration action. Your observation that resultReason now contains “User registered security info” is consistent with this enhanced logging behavior and does not indicate a misconfiguration.

To inspect these changes programmatically, use the Entra PowerShell reports modules and filter on the Authentication Methods service, for example:

Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
$userId = (Get-EntraUser -UserId '******@contoso.com').Id
Get-EntraAuditDirectoryLog -Filter "category eq 'UserManagement' and LoggedByService eq 'Authentication Methods' and targetResources/any(r:r/id eq '$userId')"

This returns the same style of entries, including ActivityDisplayName and ResultReason, for MFA / security info registration events.

---

References:

• Microsoft Entra audit log categories and activities
• Troubleshooting combined security information registration
• Get-EntraAuditDirectoryLog
• Get-EntraBetaAuditDirectoryLog