name: Azure Active Directory Update user
id: 5495c90a-047c-4b8e-b2fe-1db6282d3872
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs an event when a user account is updated in Azure Active Directory.
mitre_components:
    - User Account Modification
    - User Account Metadata
source: Azure AD
sourcetype: azure:monitor:aad
separator: operationName
separator_value: Update user
supported_TA:
    - name: Splunk Add-on for Microsoft Cloud Services
      url: https://splunkbase.splunk.com/app/3110
      version: 6.1.1
fields:
    - _time
    - Level
    - callerIpAddress
    - category
    - correlationId
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - durationMs
    - host
    - index
    - linecount
    - operationName
    - operationVersion
    - properties.activityDateTime
    - properties.activityDisplayName
    - properties.additionalDetails{}.key
    - properties.additionalDetails{}.value
    - properties.category
    - properties.correlationId
    - properties.id
    - properties.initiatedBy.user.displayName
    - properties.initiatedBy.user.id
    - properties.initiatedBy.user.ipAddress
    - properties.initiatedBy.user.userPrincipalName
    - properties.loggedByService
    - properties.operationType
    - properties.result
    - properties.resultReason
    - properties.targetResources{}.displayName
    - properties.targetResources{}.id
    - properties.targetResources{}.modifiedProperties{}.displayName
    - properties.targetResources{}.modifiedProperties{}.newValue
    - properties.targetResources{}.modifiedProperties{}.oldValue
    - properties.targetResources{}.type
    - properties.targetResources{}.userPrincipalName
    - properties.userAgent
    - punct
    - resourceId
    - resultSignature
    - source
    - sourcetype
    - splunk_server
    - tenantId
    - time
    - timeendpos
    - timestartpos
output_fields:
    - dest
    - user
    - src
    - vendor_account
    - vendor_product
example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413199", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-07-24T14:28:15.2233481+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Member\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Member"}]}}'