Azure Application Deleted

Title: Azure Application Deleted
Status: test
Description:Identifies when a application is deleted in Azure.
References:
  -https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
  -https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  -https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415
Author: Austin Songer @austinsonger
Date: 2021-09-03
modified:2026-04-30
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• product: azure
• service: auditlogs

Detection:
  selection:
    operationName:
      -'Delete application'
      -'Hard Delete application'
      -'Delete administrative unit'

  condition:selection
Falsepositives:
  -Application being deleted may be performed by a system administrator.
  -Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  -Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Level: medium