Azure Audit Logs: Application Deletion via Entra Admin Operations

title: "Azure Audit Logs: Application Deletion via Entra Admin Operations"
id: 5f91c9e8-4d09-4bb9-ac47-72c77d5b61f8
status: test
description: This rule flags Azure audit log events where an application is deleted, including both standard and hard-delete operations, as well as deletion of an administrative unit. Attackers may remove applications to disrupt access paths, evade monitoring, or reduce the visibility of identity configurations. It relies on Azure audit log telemetry capturing the operation name for delete-related actions.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_application_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
  - attack.impact
  - attack.t1489
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - Delete application
      - Hard Delete application
      - Delete administrative unit
  condition: selection
falsepositives:
  - Application being deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 410d2a41-1e6d-452f-85e5-abdd8257a823
    type: derived