Logs generated by Azure AD Provisioning.

Table attributes

Attribute Value
Resource types -
Categories Audit, Security
Solutions LogManagement
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes


Column Type Description
AADTenantId string Unique Azure AD tenant ID
_BilledSize real The record size in bytes
Category string Category of the event
ChangeId string Unique ID of this change in this cycle
CorrelationId string ID to provide provisioning trail
CycleId string Unique ID per job iteration
DurationMs long Indicates how long this provisioning action took to finish
Id string Indicates the unique ID for the activity
InitiatedBy string Details of who initiated this provisioning
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
JobId string The unique ID for the whole provisioning job
ModifiedProperties string Details of each property that was modified in this provisioning action on this object
OperationName string Name of the operation
OperationVersion string The REST API version that's requested by the client
ProvisioningAction string Indicates the activity name or the operation name. For a list of activities logged, refer to Azure AD activity list
ProvisioningStatusInfo string Details of provisioning status
ProvisioningSteps string Details of each step in provisioning
ResultDescription string When available, provides the error description for the provisioning operation
ResultSignature string Contains the error code, if any, for the provisioning operation
ResultType string The result of the provisioning operation can be Success, Failure, or Skipped
ServicePrincipal string Represents the service principal used for provisioning
SourceIdentity string Details of source object being provisioned
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TargetIdentity string Details of target object being provisioned
TargetSystem string Details of target system of the object being provisioned
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The date and time of the event in UTC
Type string The name of the table