Identity / Authentication and sign-in
AADProvisioningLogs
User and group provisioning events showing sync operations between Entra ID and connected systems
Recommendation
High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.
How the matrix worksC3 Identity, privilege, and configuration changes
Identity, privilege, and configuration changes: directory audit, cloud control plane, RBAC, Kubernetes API, security tool administration, virtualisation and MDM management
ACSC
- 2. Network device logsConfiguration changes
- 6. Virtualisation system logs
- 8. Cloud platform logging
- 9. Container logs
- 11. Mobile device management
CISA
- 1. Identity, credential, and access management (ICAM)1a Manage and track changes in attributes and credentials
- 4. Cloud environments (general logging)4a Any activity on breakglass accounts
- 5. Amazon Web Services (AWS)5a AWS CloudTrail
- 6. Cloud Azure6a-6b Azure Active Directory logs and Azure Activity
- 8. Google Cloud Platform (GCP)8a Admin audit
MITRE data sources
- User Account: User Account Creation
- User Account: User Account Modification
T4 Investigation context
Low-touch context queried during investigations rather than for alerting.
Lake supported in the Azure Monitor table feature matrix
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
- CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.