> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/directory-audit-alerts.md). # Directory Audit Alerts These alerts fire on Microsoft Entra ID (Azure AD) directory-level administrative actions — the day-to-day changes admins and users make to accounts, applications, devices, groups, policies, and roles. | Alert | Category | Severity | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------- | --------------------------------------------- | | **Add A Partner To Cross Tenant Access Setting** `office365_directoryaudit_add_a_partner_to_cross_tenant_access_setting` | Cross Tenant Access Settings | High | | **Add Application** `office365_directoryaudit_add_application` | Application Management | Low | | **Add conditional access policy** `office365_directoryaudit_add_conditional_access_policy` | Access Governance | Informational | | **Add Device** `office365_directoryaudit_add_device` | Device | Low | | **Add Member To Role Outside of PIM (permanent)** `office365_directoryaudit_add_member_to_role_outside_of_pim` | Resource Management | High | | **Add Owner** `office365_directoryaudit_add_owner` | Application Management | Low | | **Add Service Principal Credentials** `office365_directoryaudit_add_service_principal_credentials` | Application Management | Medium | | **Add User** `office365_directoryaudit_add_user` | User Management | Low | | **Admin Deleted Security Info** `office365_directoryaudit_admin_deleted_security_info` | User Management | High | | **Admin registered additional security info inside of safe country** `office365_directoryaudit_admin_registered_additional_security_info_inside_of_safe_country` | User Management | Medium | | **Admin registered additional security info outside of safe country** `office365_directoryaudit_admin_registered_additional_security_info_outside_of_safe_country` | User Management | High | | **Admin registered security info inside safe country** `office365_directoryaudit_admin_registered_security_info_inside_safe_country` | User Management | Low | | **Admin registered security info outside safe country** `office365_directoryaudit_admin_registered_security_info_outside_safe_country` | User Management | High | | **Change Password Self-Service** `office365_directoryaudit_change_password_selfservice` | User Management | Low | | **Change User License** `office365_directoryaudit_change_user_license` | User Management | Low | | **Change User Password** `office365_directoryaudit_change_user_password` | User Management | Low | | **Consent to application** `office365_directoryaudit_consent_to_application` | Microsoft Cloud App Security | Informational | | **Delete conditional access policy** `office365_directoryaudit_delete_conditional_access_policy` | Access Governance | Informational | | **Delete Policy** `office365_directoryaudit_delete_policy` | Policy | Medium | | **Device No Longer Compliant** `office365_directoryaudit_device_no_longer_compliant` | Device | Low | | **Device No Longer Managed** `office365_directoryaudit_device_no_longer_managed` | Device | Medium | | **Disable Account** `office365_directoryaudit_disable_account` | User Management | Low | | **Disable Strong Authentication** `office365_directoryaudit_disable_strong_authentication` | User Management | High | | **Enable Account** `office365_directoryaudit_enable_account` | User Management | Low | | **Invite External User** `office365_directoryaudit_invite_external_user` | User Management | Low | | **Redeem External User Invite** `office365_directoryaudit_redeem_external_user_invite` | User Management | Low | | **Register Device** `office365_directoryaudit_register_device` | Device | Low | | **Registered security info from unknown location** `office365_directoryaudit_registered_security_info_from_unknown_location` | User Management | Variable — depends on the detected risk level | | **Remove Delegated Permission Grant** `office365_directoryaudit_remove_delegated_permission_grant` | Application Management | Low | | **Remove Member From Group** `office365_directoryaudit_remove_member_from_group` | Group Management | Low | | **Remove Owner From Group** `office365_directoryaudit_remove_owner_from_group` | Group Management | Low | | **Reset password (by admin)** `office365_directoryaudit_reset_password_by_admin` | Access Governance | Informational | | **Reset Password Self-Service** `office365_directoryaudit_reset_password_selfservice` | User Management | Low | | **Reset user password** `office365_directoryaudit_reset_user_password` | Access Governance | Informational | | **Set Verified Publisher** `office365_directoryaudit_set_verified_publisher` | User Management | Low | | **Triggered PIM Alert** `office365_directoryaudit_triggered_pim_alert` | Resource Management | High | | **Update Application** `office365_directoryaudit_update_application` | Application Management | Low | | **Update Application Certificates And Secrets Management** `office365_directoryaudit_update_application_certificates_and_secrets_management` | Application Management | Medium | | **Update Conditional Access Policy** `office365_directoryaudit_update_conditional_access_policy` | Policy | Medium | | **Update Policy** `office365_directoryaudit_update_policy` | Policy | Low | | **Update Role** `office365_directoryaudit_update_role` | Role Management | Medium | | **User Changed Default Security Info** `office365_directoryaudit_user_changed_default_security_info` | User Management | Low | | **User Deleted Security Info** `office365_directoryaudit_user_deleted_security_info` | User Management | Low | | **User registered additional security info inside of safe country** `office365_directoryaudit_user_registered_additional_security_info_inside_of_safe_country` | User Management | Medium | | **User registered additional security info outside of safe country** `office365_directoryaudit_user_registered_additional_security_info_outside_of_safe_country` | User Management | High | | **User registered security info inside safe country** `office365_directoryaudit_user_registered_security_info_inside_safe_country` | User Management | Low | | **User registered security info outside safe country** `office365_directoryaudit_user_registered_security_info_outside_safe_country` | User Management | High | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/directory-audit-alerts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.