Microsoft Entra ID

Track and investigate identity activities with linkable identifiers in Microsoft Entra

8 September 2026Doc update+63 / −2 lines

In brief

The documentation now explains how supported audit events can include DUSI, maps linkable identifiers to audit-log attributes, and provides steps for correlating sign-ins with administrative activity. Some events may not include DUSI.

What Entra admins need to know

No configuration change or deadline is stated. Administrators can use DUSI to investigate suspicious sessions and trace related changes.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Log availability for linkable identifiers

Currently, one or more linkable identifiers are recorded in the following log sources:

Microsoft Entra sign-in logs
Microsoft Entra audit logs
Microsoft Exchange Online audit logs
Microsoft Graph activity logs
Microsoft SharePoint Online audit logs

Start with the User ID attribute in Microsoft Entra sign-in logs, then search the workload audit logs to track all activities using a specific access token. Similarly, use the Session ID attribute to search the workload audit logs and track all activities within a session.

Linkable identifiers in Microsoft Exchange OnlineEntra audit logs

~~Exchange Online audit logs~~Microsoft Entra audit logs provide visibility into ~~critical user activity~~administrative and ~~support in-depth investigations by capturing detailed audit events.~~directory operations in a tenant. These logs capture activities such as user and group management, application and service principal changes, role assignments, policy updates, and device lifecycle events.

For supported audit events, the logs include the directory user session identifier (DUSI). DUSI enables security analysts to correlate an administrative operation with the authenticated user session from which the operation originated.

Investigation scenarios using DUSI

For scenarios involving administrative activity, you can:

Start with DUSI from a Microsoft Entra sign-in log.
Use the identifier to find events from the same authenticated session in Microsoft Entra audit logs.
Correlate sign-in activity with subsequent administrative operations.
Trace configuration changes performed during a specific authenticated session.
Investigate privileged operations associated with a suspicious or compromised account.

This correlation establishes an audit trail from authentication through subsequent administrative actions.

Linkable identifier mapping

The following table maps linkable ~~identifiers carried forward~~identifier claims to their attribute names in Microsoft Entra audit logs.

Claim	Microsoft Entra audit log attribute name	Description
oid	Object ID	The immutable identifier of the user or service principal that initiated the operation.
tid	Tenant ID	The identifier of the tenant where the operation was recorded.
sid	Session ID	The identifier that links the operation to the authenticated user session.
deviceid	Device ID	The identifier of the device associated with the session, when available.
uti	Unique Token Identifier	The unique, case-sensitive identifier of the token or request associated with the operation.
iat	Issued at datetime	The date and time when the token associated with the operation was issued.

Correlate sign-in activity with audit logs

Use the same DUSI value to correlate Microsoft Entra sign-in logs with Microsoft Entra audit logs:

Identify a suspicious sign-in in Microsoft Entra sign-in logs.
Capture the associated DUSI value.
Search Microsoft Entra audit logs for the same DUSI value.
Review the administrative and directory operations associated with the authenticated session.

This approach helps you determine whether a sign-in resulted in changes to users, groups, applications, devices, policies, or role assignments.

:::image type="content" border="true" source="media/how-to-authentication-track-linkable-identifiers/entra-audit-log-linkable-identifier.png" alt-text="Screenshot of Microsoft Entra audit log details showing a session ID and synthetic example values." lightbox="media/how-to-authentication-track-linkable-identifiers/entra-audit-log-linkable-identifier.png":::

Example: Investigate administrative activity from a compromised session

Suppose an administrator account is suspected of being compromised after a suspicious sign-in. By using the DUSI captured from Microsoft Entra ~~tokens, enabling correlation~~sign-in logs, you can:

Identify Microsoft Entra audit log events associated with the session.
Review role assignment changes.
Investigate Conditional Access policy updates.
Examine application and service principal modifications.
Determine the overall impact of the session.

Using DUSI across ~~authentication artifacts~~Microsoft Entra sign-in and ~~workloads.~~audit logs helps security teams trace administrative activity back to the originating authenticated session.

Linkable identifiers in Microsoft Exchange Online logs

Exchange Online audit logs provide visibility into critical user activity and support in-depth investigations by capturing detailed audit events. These logs include linkable identifiers carried forward from Microsoft Entra tokens, enabling correlation across authentication artifacts and workloads.

@@ -2,7 +2,8 @@ title: Track and investigate identity activities with linkable identifiers in Microsoft Entra description: Discover how linkable identifiers like session IDs and unique token identifiers in Microsoft Entra help track and investigate identity-related activities, enhancing security and transparency. ms.topic: how-to-ms.date: 05/27/2025+ms.date: 09/02/2026+ai-usage: ai-assisted ms.subservice: hybrid ms.custom: msecd-doc-authoring-106 ms.reviewer: vranganathan@@ -49,9 +50,10 @@ This table describes all the linkable identifier claims in the Entra tokens.  ## Log availability for linkable identifiers -Currently, linkable identifiers are recorded in the following log sources:+Currently, one or more linkable identifiers are recorded in the following log sources:  - Microsoft Entra sign-in logs+- Microsoft Entra audit logs - Microsoft Exchange Online audit logs - Microsoft Graph activity logs - Microsoft SharePoint Online audit logs@@ -86,6 +88,65 @@ To view the sign-in logs from the Microsoft Entra admin center:  Start with the User ID attribute in Microsoft Entra sign-in logs, then search the workload audit logs to track all activities using a specific access token. Similarly, use the Session ID attribute to search the workload audit logs and track all activities within a session. +## Linkable identifiers in Microsoft Entra audit logs++[Microsoft Entra audit logs](~/identity/monitoring-health/concept-audit-logs.md) provide visibility into administrative and directory operations in a tenant. These logs capture activities such as user and group management, application and service principal changes, role assignments, policy updates, and device lifecycle events.++For supported audit events, the logs include the directory user session identifier (DUSI). DUSI enables security analysts to correlate an administrative operation with the authenticated user session from which the operation originated.++### Investigation scenarios using DUSI++For scenarios involving administrative activity, you can:++- Start with DUSI from a Microsoft Entra sign-in log.+- Use the identifier to find events from the same authenticated session in Microsoft Entra audit logs.+- Correlate sign-in activity with subsequent administrative operations.+- Trace configuration changes performed during a specific authenticated session.+- Investigate privileged operations associated with a suspicious or compromised account.++This correlation establishes an audit trail from authentication through subsequent administrative actions.++### Linkable identifier mapping++The following table maps linkable identifier claims to their attribute names in Microsoft Entra audit logs.++| **Claim** | **Microsoft Entra audit log attribute name** | **Description** |+|-----------|----------------------------------------------|-----------------|+| oid       | Object ID                                    | The immutable identifier of the user or service principal that initiated the operation. |+| tid       | Tenant ID                                    | The identifier of the tenant where the operation was recorded. |+| sid       | Session ID                                   | The identifier that links the operation to the authenticated user session. |+| deviceid  | Device ID                                    | The identifier of the device associated with the session, when available. |+| uti       | Unique Token Identifier                      | The unique, case-sensitive identifier of the token or request associated with the operation. |+| iat       | Issued at datetime                           | The date and time when the token associated with the operation was issued. |++### Correlate sign-in activity with audit logs++Use the same DUSI value to correlate Microsoft Entra sign-in logs with Microsoft Entra audit logs:++1. Identify a suspicious sign-in in Microsoft Entra sign-in logs.+1. Capture the associated DUSI value.+1. Search Microsoft Entra audit logs for the same DUSI value.+1. Review the administrative and directory operations associated with the authenticated session.++This approach helps you determine whether a sign-in resulted in changes to users, groups, applications, devices, policies, or role assignments.++:::image type="content" border="true" source="media/how-to-authentication-track-linkable-identifiers/entra-audit-log-linkable-identifier.png" alt-text="Screenshot of Microsoft Entra audit log details showing a session ID and synthetic example values." lightbox="media/how-to-authentication-track-linkable-identifiers/entra-audit-log-linkable-identifier.png":::++### Example: Investigate administrative activity from a compromised session++Suppose an administrator account is suspected of being compromised after a suspicious sign-in. By using the DUSI captured from Microsoft Entra sign-in logs, you can:++- Identify Microsoft Entra audit log events associated with the session.+- Review role assignment changes.+- Investigate Conditional Access policy updates.+- Examine application and service principal modifications.+- Determine the overall impact of the session.++Using DUSI across Microsoft Entra sign-in and audit logs helps security teams trace administrative activity back to the originating authenticated session.++> [!NOTE]+> DUSI is intended for investigation and correlation scenarios. A session identifier is available only when the audit event includes authenticated user-session context. Some service-generated, background, or otherwise unsupported audit events might not include a DUSI value.+ ## Linkable identifiers in Microsoft Exchange Online logs  Exchange Online audit logs provide visibility into critical user activity and support in-depth investigations by capturing detailed audit events. These logs include linkable identifiers carried forward from Microsoft Entra tokens, enabling correlation across authentication artifacts and workloads.