Query Details
//When an agent is removed from Entra, the agentic user behind the identity is also removed AuditLogs | where OperationName == @"Delete user" | where Identity == @"Security Copilot Agent Management"
This query is searching through audit logs to find instances where a user has been deleted. Specifically, it is looking for deletions that were performed by the "Security Copilot Agent Management" identity. In simple terms, it's identifying when an agent is removed from Entra (a system or platform), which also results in the removal of the user associated with that agent.

Jay Kerai
Released: February 17, 2026
Tables
Keywords
Operators