Forum Discussion
Need Clarification on "Update user" operation in Audit Log
Hello Sentinel Community, I recently came across an event in my Azure Sentinel instance that I'm seeking clarification on. The event shows an operation labeled "Update user" and the display name as ...
I'm pretty sure that StrongAuthenticationPhoneAppDetail holds the phone details for MFA, so you are seeing the user updating something like their phone number / setting etc...
https://answers.microsoft.com/en-us/msoffice/forum/all/powershell-to-see-what-device-mfa-is-registered-on/97502ea3-5988-4c01-93d3-366243e3e1b5
https://answers.microsoft.com/en-us/msoffice/forum/all/powershell-to-see-what-device-mfa-is-registered-on/97502ea3-5988-4c01-93d3-366243e3e1b5