Tools · Identity defense · 25 / 25
Entra: the resource name is not the app name
appDisplayName is the application on the sign-in. resourceDisplayName is the resource, when that field is present. Write the field you have. Do not copy one name into the other.
The app field is the application
When a sign-in row includes appDisplayName, that string is the application recorded for the sign-in. Quote it as the app. It is not automatically the resource the application reached.
If appDisplayName is absent, write “app name not on this row.” Do not borrow the resource string to fill it.
The resource field is separate
resourceDisplayName, when present, is the resource named on that row. It can match the app name or differ. If it differs, keep both. If you only have the resource, you do not yet have the app name.
A sentence about “what they opened inside the app” is still not either field. Those contents are not on the sign-in row.
What to file
File the sign-in id and each name with its field. “App” and “resource” have to match the columns. A ticket title that uses only one word should say which field it came from.
Worked case: a resource string filed as the app
Sign-in s-19 shows resourceDisplayName Microsoft Graph and no appDisplayName. A draft says the application was Microsoft Graph because that is the only name on the row.
The note quotes Microsoft Graph as the resource. App name: not on this row. The draft’s application sentence is removed until an app field is actually present.
sign-in: s-19 resourceDisplayName: Microsoft Graph appDisplayName: absent write: resource only not: the application is Microsoft Graph
Diagram
The app field and the resource field
A single name does not fill both columns.
Is. The application, when the row has it
Absent. Say the app name was not on the row
Does not. Get copied from the resource
Is. The resource named on the row
Example. Microsoft Graph, if that is the field
Does not. List items opened inside an app
Check yourself
1. The row has resourceDisplayName Microsoft Graph and no appDisplayName. What can you call the application?
2. Both fields are present and they differ. What do you file?
3. Why is “which files were opened” not on this row?