Decoding Microsoft 365 Audit Log Events Using Bitfield Mapping Technique – Investigation Report
Authentication events within Microsoft cloud services generate logs across various systems. Specifically, Microsoft Entra sign-in logs and Microsoft 365 audit logs capture similar authentication events but differ in data representation formats.
Authentication events within Microsoft cloud services generate logs across various systems. Specifically, Microsoft Entra sign-in logs and Microsoft 365 audit logs capture similar authentication events but differ in data representation formats.
In Microsoft 365 sign-in events, the UserAuthenticationMethod field often displays numeric values such as 16, 272, or 33554432. These values are not officially documented by Microsoft, posing challenges to security analysts who aim to analyze authentication activities, detect suspicious logins, or evaluate phishing-resistant authentication implementation.
Through correlation analysis between Microsoft Entra sign-in logs and Microsoft 365 audit logs, it was identified that the UserAuthenticationMethod field functions as a bitfield. Each bit position within this field represents a specific authentication method.
Decoding the Bitfield Mapping Technique
This discovery allows security professionals to convert numeric values into readable descriptions of authentication methods. The research team mapped each bit position to an authentication method using correlation identifiers shared between the logging systems. Microsoft 365 audit logs use an InterSystemsId field, while Entra ID logs include a correlationId field, both referencing identical events.
Authentication events within Microsoft cloud services generate logs across various systems.
By aligning events across these sources, researchers correlated numeric UserAuthenticationMethod values with detailed descriptions found in Entra ID's authenticationMethodDetail fields.
The bitfield structure permits multiple authentication methods to be represented simultaneously within a single numeric value. For example, the value 272 translates to binary as 100010000, indicating "Password Hash Sync via Staged Rollout" as the authentication mechanism.
Bit 0 (Decimal 1): Password in the cloud Bit 1: Temporary Access Pass Bit 2: Seamless SSO Bit 18 (Decimal 262144): Windows Hello for Business Bit 25 (Decimal 33554432): Passkey
Several bits remain unmapped, including positions 5, 7, 9-17, 22, and 26, which require further investigation.
Based on reporting by Cyber Security News.