Decoding Microsoft 365 Audit Logs Using Bitfield Mapping: An Investigation Report

Understanding user authentication methods for cloud services is essential for security monitoring. A recently developed bitfield mapping technique decodes the UserAuthenticationMethod values in Microsoft 365 audit logs, converting numeric codes into human-readable descriptions. This advancement aids incident responders in identifying primary authentication methods, even when only Microsoft 365 audit logs are available.

When users sign in to Microsoft's cloud services, authentication events are logged in both Microsoft Entra sign-in logs and Microsoft 365 audit logs. These logs capture the same events but store authentication details differently: Entra logs use plain text, while Microsoft 365 audit logs use numeric values such as 16, 272, or 33554432 without official documentation.

Analysts at Sekoia.io discovered that these numeric values represent a bitfield, with each set bit indicating a specific primary authentication method. By converting the numeric value to binary, security teams can determine which authentication methods were used during sign-in, including complex methods like "Password Hash Sync via Staged Rollout."

Researchers correlated Microsoft 365 audit log entries with Entra ID sign-in logs using correlation identifiers (InterSystemsId in audit logs and correlationId in Entra logs). This allowed them to match each bit's decimal value to its corresponding authentication method. For example, bit 4 (decimal 16) indicates Password Hash Sync, while bit 8 (decimal 256) signifies a method deployed via Staged Rollout. A value of 272 (binary 100010000) represents "Password Hash Sync via Staged Rollout."

This mapping methodology is accomplished through a two-step Sekoia Operating Language (SOL) query: first, retrieve Microsoft 365 records with the target UserAuthenticationMethod value; second, fetch correlated Entra ID events to rank authentication methods by occurrence. SOL's filtering and aggregation capabilities make it suitable for large-scale log analysis.

Real-World Application and Limitations

This mapping enables security analysts to identify phishing-resistant methods, such as Passkeys (decimal 33554432) and Windows Hello for Business (decimal 262144), directly from Microsoft 365 logs. It also aids in monitoring staged rollout progress for hybrid authentication deployments. However, the bitfield only captures primary-capable methods, excluding common secondary-only factors like Microsoft Authenticator push notifications.

Some bit positions remain unmapped due to their absence in observed logs. As Microsoft introduces new authentication options, additional analysis will be needed to maintain current mappings. The investigation team encourages the community to validate these findings, report mappings for unmapped bits, and request official documentation from Microsoft to clarify the bitfield structure.

By elucidating the UserAuthenticationMethod bitfield structure, this technique enhances incident response, compliance auditing, and risk assessment in environments relying on Microsoft 365 audit logs.

Based on reporting by GBHackers.