Microsoft.AAD/DomainServices
11 diagnostic categories routing into 8 Log Analytics tables.
Source: Microsoft Learn
Diagnostic categories
-
AccountLogon
Ingestion-time transform PII- Routes to
- AADDomainServicesAccountLogon
-
AccountManagement
Ingestion-time transform PII- Routes to
- AADDomainServicesAccountManagement
-
DetailTracking
-
DirectoryServiceAccess
Ingestion-time transform- Routes to
- AADDomainServicesDirectoryServiceAccess
-
DNSServerAuditsDynamicUpdates
DNSServerAuditsDynamicUpdates - Preview
Basic Logs Ingestion-time transform Cost to export- Routes to
- AADDomainServicesDNSAuditsDynamicUpdates
-
DNSServerAuditsGeneral
DNSServerAuditsGeneral - Preview
Basic Logs Ingestion-time transform Cost to export- Routes to
- AADDomainServicesDNSAuditsGeneral
-
LogonLogoff
Ingestion-time transform- Routes to
- AADDomainServicesLogonLogoff
-
ObjectAccess
-
PolicyChange
Ingestion-time transform- Routes to
- AADDomainServicesPolicyChange
-
PrivilegeUse
Ingestion-time transform- Routes to
- AADDomainServicesPrivilegeUse
-
SystemSecurity
Destination tables
-
AADDomainServicesAccountLogon
PII27 columns in this table.
-
AADDomainServicesAccountManagement
PII53 columns in this table.
-
AADDomainServicesDirectoryServiceAccess
28 columns in this table.
-
AADDomainServicesDNSAuditsDynamicUpdates
DNS server audit events enable change tracking on the DNS server. This table contains operational audit events for dynamic updates.
20 columns in this table.
-
AADDomainServicesDNSAuditsGeneral
DNS server audit events enable change tracking on the DNS server. An audit event is logged each time server, zone, or resource record settings are changed. This includes operational events such as zone transfers, and DNSSEC zone signing and unsigning. This table captures audit events that are not from dynamic updates.
118 columns in this table.
-
AADDomainServicesLogonLogoff
40 columns in this table.
-
AADDomainServicesPolicyChange
62 columns in this table.
-
AADDomainServicesPrivilegeUse
19 columns in this table.