kqlHunting

Security Copilot Agent Deleted

When an agent is removed from Entra, the agentic user behind the identity is also removed

Detection Query

//When an agent is removed from Entra, the agentic user behind the identity is also removed
AuditLogs
| where OperationName == @"Delete user"
| where Identity == @"Security Copilot Agent Management"

Data Sources

AuditLogs

Platforms

azure-ad

Tags

entra

Raw Content

//When an agent is removed from Entra, the agentic user behind the identity is also removed
AuditLogs
| where OperationName == @"Delete user"
| where Identity == @"Security Copilot Agent Management"