Decoding Microsoft 365 Audit Logs Using Bitfield Mapping: An Investigation Report

A recent bitfield mapping technique decodes the opaque UserAuthenticationMethod values in Microsoft 365 audit logs, turning numeric codes such as 16, 272 and 33554432 into human-readable authentication details.

Analysts have shown that these integers represent a bitfield, with each set bit indicating a primary authentication method; for example, bit 4 (decimal 16) indicates Password Hash Sync, while bit 8 (decimal 256) signals a method deployed via Staged Rollout, and a value of 272 (binary 100010000) represents Password Hash Sync via Staged Rollout.

When users sign in to Microsoft’s cloud services, authentication events appear in both Microsoft Entra sign-in logs and Microsoft 365 audit logs, which store details in different formats. The mapping uses correlated logs—Entra ID events provide authenticationMethod fields to match bits to methods, aided by two-step SOL queries to retrieve and cross‑reference Microsoft 365 records with the target UserAuthenticationMethod value and Entra ID events.

According to Sekoia[.]io, this approach enables identifying phishing‑resistant methods such as Passkeys (33554432) and Windows Hello for Business (262144) directly from these logs.