Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Reference for AADProvisioningLogs table in Azure Monitor Logs.
| Attribute | Value |
|---|---|
| Category | Entra |
| Basic Logs Eligible | ✓ Yes (source) |
| Supports Transformations | ✓ Yes (source) |
| Ingestion API Supported | ✗ No |
| Azure Monitor Tables Reference | View Documentation |
Source: Azure Monitor documentation
| Column Name | Type | Description |
|---|---|---|
| _BilledSize | real | The record size in bytes |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account |
| AADTenantId | string | Unique Azure AD tenant ID |
| Category | string | Category of the event |
| ChangeId | string | Unique ID of this change in this cycle |
| CorrelationId | string | ID to provide provisioning trail |
| CycleId | string | Unique ID per job iteration |
| DurationMs | long | Indicates how long this provisioning action took to finish |
| Id | string | Indicates the unique ID for the activity |
| InitiatedBy | string | Details of who initiated this provisioning |
| JobId | string | The unique ID for the whole provisioning job |
| ModifiedProperties | string | Details of each property that was modified in this provisioning action on this object |
| OperationName | string | Name of the operation |
| OperationVersion | string | The REST API version that's requested by the client |
| ProvisioningAction | string | Indicates the activity name or the operation name. For a list of activities logged, refer to Azure AD activity list |
| ProvisioningStatusInfo | string | Details of provisioning status |
| ProvisioningSteps | string | Details of each step in provisioning |
| ResultDescription | string | When available, provides the error description for the provisioning operation |
| ResultSignature | string | Contains the error code, if any, for the provisioning operation |
| ResultType | string | The result of the provisioning operation can be Success, Failure, or Skipped |
| ServicePrincipal | string | Represents the service principal used for provisioning |
| SourceIdentity | string | Details of source object being provisioned |
| SourceSystem | string | The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics |
| TargetIdentity | string | Details of target object being provisioned |
| TargetSystem | string | Details of target system of the object being provisioned |
| TenantId | string | The Log Analytics workspace ID |
| TimeGenerated | datetime | The date and time of the event in UTC |
| Type | string | The name of the table |
This table is used by the following solutions:
This table is ingested by the following connectors:
| Connector | Selection Criteria |
|---|---|
| Microsoft Entra ID |
GitHub Only:
| Workbook | Selection Criteria |
|---|---|
| AzureLogCoverage | |
| MicrosoftSentinelDeploymentandMigrationTracker | |
| SentinelWorkspaceReconTools |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊