Entra Id Change Auditing
You set up entra id change auditing by turning on directory audit logs and sending them to a central log store. This records who changed a user role, updated a group, or edited an app rule. Most teams start by reading these logs inside the cloud portal during a review. Still, broad admin roles let users make big changes before anyone reads the log. When too many people hold wide permissions, tracking directory edits is only half the job. How entra id change auditing works in your directory Ev
Microsoft Entra ID (Azure AD) + Regulatory Change Management: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up entra id change auditing by turning on directory audit logs and sending them to a central log store. This records who changed a user role, updated a group, or edited an app rule. Most teams start by reading these logs inside the cloud portal during a review. Still, broad admin roles let users make big changes before anyone reads the log. When too many people hold wide permissions, tracking directory edits is only half the job.
How entra id change auditing works in your directory
Every time an admin updates a user, group, or role, the directory writes an event. This event records the actor, the target resource, the time, and the old and new values. Teams route these records to a central log workspace or a security tool for long-term storage. Built-in retention in the portal is short, so external storage is a must for yearly audits.
Once the logs arrive in your storage workspace, you can write alert rules for high-risk actions. For example, you should alert the security team when someone adds a user to a top admin role. You should also watch for changes to app credentials, federation rules, and conditional login policies. Good role design limits who can trigger these events in the first place. Teams often split duties so one person requests a role change and another person approves it.
What directory logs solve and the gap they leave open
Directory audit logs are great at showing who changed access rules and who logged in. They help you prove to auditors that you track group memberships and role assignments over time. If an attacker creates a new admin account, the directory log will capture that exact action. It gives you a clear timeline of identity changes across your cloud setup.
Yet directory logs stop at the front door of your databases, servers, and clusters. They tell you that an engineer got a database role and logged in at noon. They do not show what queries or commands that engineer ran inside the live session. A user with valid role permissions can still run a bad delete query by mistake. They can also pull sensitive data like emails, phone numbers, card numbers, or national IDs.
Microsoft Entra ID (Azure AD) + Regulatory Change Management: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Moving from directory tracking to runtime command control
To close this gap, teams must link identity records with real-time command checks and data controls. Instead of trusting a broad directory role for an entire session, you check each action in flight. When an engineer runs a production command, a team lead can review and approve that single command. Data masking can also rewrite matched fields like emails or card numbers in query results. This keeps raw sensitive values out of local screens while keeping the directory identity tied to every query.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits inline in the protocol beside the service as an open-source proxy, a sidecar for your database or API. On every production query an agent or human runs, hoop.dev decides whether to pass, mask, block, or escalate it for review.
Before a query runs, hoop.dev guardrails check the statement against your rules, an AI Analyzer you configure can score intent or hold risky calls for human approval, and hoop.dev data masking rewrites sensitive fields in responses in memory. Explore the MIT-licensed project on GitHub.
Frequently asked questions
How long does the directory keep change audit logs by default?
The native portal keeps directory audit logs for a short window, often thirty days. To keep records for months or years, you must export them to an external storage account.
Which directory changes should trigger an immediate alert?
You should alert on new global admin assignments, changes to conditional login rules, and new app secrets. These actions can give an attacker wide control or let them bypass normal login checks.
Does entra id change auditing show what an engineer did inside a database?
No, directory logs only show group changes, role grants, and login events at the identity layer. You need session-level command logging to see the actual SQL queries or shell commands a user ran.