Security Copilot Agent Deleted
Query
//When an agent is removed from Entra, the agentic user behind the identity is also removed
AuditLogs
| where OperationName == @"Delete user"
| where Identity == @"Security Copilot Agent Management"Explanation
This query is searching through audit logs to find instances where a user has been deleted. Specifically, it is looking for deletions that were performed by the "Security Copilot Agent Management" identity. In simple terms, it's identifying when an agent is removed from Entra (a system or platform), which also results in the removal of the user associated with that agent.