MS Sentinel Parsers - User account disable/enable events across local account and Entra contexts

Question

MS Sentinel Parsers - User account disable/enable events across local account and Entra contexts

Matthew Thompson 0

I need an IM parser that can grab Event ID 4772 events, as well as grab "Enable account" operation events from the Azure AuditLog table.

Does an out of the box parser exist for this use-case? I can see there's _Im_UserManagement parser for the local account audit logs but I do not see one that targets the Entra account management events.

//Entra account management events
AuditLogs
| where OperationName =~ "Enable account"

//Event ID 4772
_Im_UserManagement(eventtype_in=dynamic(['UserEnabled']))

Many thanks

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-24T06:13:25.72+00:00
Hello Matthew Thompson,

There isn’t a built-in ASIM parser that combines Windows account events with Entra “Enable/Disable account” actions. _Im_UserManagement covers Windows/on-prem events (4722 = enable, 4725 = disable), while Entra changes are logged in AuditLogs and aren’t mapped into that schema.

You can pull both together like this:

let local = _Im_UserManagement(eventtype_in=dynamic(['UserEnabled','UserDisabled'])); let entra = AuditLogs | where OperationName has_any ("Enable account","Disable account") | extend Account = tostring(parse_json(TargetResources)[0].userPrincipalName), EventType = iff(OperationName == "Enable account","UserEnabled","UserDisabled"), Actor = tostring(InitiatedBy.user.userPrincipalName) | project TimeGenerated, Account, EventType, Actor; union local, entra | sort by TimeGenerated desc

If you need this in multiple places, you can wrap it into a custom parser and reuse it in analytics or workbooks.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-27T13:28:31.2966667+00:00

Hello Matthew Thompson,

Any update on this? Please confirm if you still have further queries on this.
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2026-04-01T12:15:33.3666667+00:00

@Matthew Thompson, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-24T06:13:25.72+00:00

Hello Matthew Thompson,

There isn’t a built-in ASIM parser that combines Windows account events with Entra “Enable/Disable account” actions. _Im_UserManagement covers Windows/on-prem events (4722 = enable, 4725 = disable), while Entra changes are logged in AuditLogs and aren’t mapped into that schema.

You can pull both together like this:

let local = _Im_UserManagement(eventtype_in=dynamic(['UserEnabled','UserDisabled'])); let entra = AuditLogs | where OperationName has_any ("Enable account","Disable account") | extend Account = tostring(parse_json(TargetResources)[0].userPrincipalName), EventType = iff(OperationName == "Enable account","UserEnabled","UserDisabled"), Actor = tostring(InitiatedBy.user.userPrincipalName) | project TimeGenerated, Account, EventType, Actor; union local, entra | sort by TimeGenerated desc

If you need this in multiple places, you can wrap it into a custom parser and reuse it in analytics or workbooks.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-27T13:28:31.2966667+00:00

Hello Matthew Thompson,

Any update on this? Please confirm if you still have further queries on this.
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2026-04-01T12:15:33.3666667+00:00

@Matthew Thompson, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Answer 1

Yes. The out-of-the-box ASIM unifying parser for this use case is the User Management schema parser:

_Im_UserManagement

This parser is designed to normalize user management events (such as user enable/disable, create/delete, password changes, group changes) from multiple sources into a single schema. It already supports filtering parameters like eventtype_in and time filters:

_Im_UserManagement(
    eventtype_in = dynamic(["UserEnabled"]),
    starttime    = ago(1d),
    endtime      = now()
)

For Windows/local account events (for example, Security Event ID 4772) the unifying parser will route to the appropriate source-specific parser, such as:

_Im_UserManagement_MicrosoftSecurityEventVxx for Windows SecurityEvent
_Im_UserManagement_MicrosoftWindowsEventVxx for WindowsEvent

For other platforms (AWS, Linux, Cisco ISE, SentinelOne, etc.), the same _Im_UserManagement unifying parser will route to the relevant source-specific _Im_UserManagement_*Vxx parser listed under the User Management parsers.

To cover Entra account management events (like Enable account in AuditLogs) with ASIM, those events must first be normalized into the User Management schema (for example, into the ASimUserManagementLogs table) or another supported source table that has a corresponding _Im_UserManagement_* parser. Once normalized, they are automatically included in _Im_UserManagement queries alongside the Windows/local account events.

If Entra AuditLogs are not yet normalized to the User Management schema in the workspace, they will not appear via _Im_UserManagement and must still be queried directly from AuditLogs as in the sample:

AuditLogs
| where OperationName =~ "Enable account"

In summary:

There is an out-of-the-box unifying parser for user management events: _Im_UserManagement.
It already supports Windows/local account events and any other sources listed in the User Management parsers table.
Entra AuditLogs must be onboarded/normalized into the User Management schema (or a supported source) to be surfaced via _Im_UserManagement; otherwise, they remain accessible only via direct AuditLogs queries.

References: