CODEWITHSUNDEEP
azurekqlazure-dashboard
abeylisco
abeylisco

Reputation: 1

Azure KQL Query on Dashboard

KQL query to reveal Azure Activity actions which should include users management activities based on any change performed by a users (create, update &delete) &identify the user by email/profile, tenant ID, subscription, activity logs under a tenant subscription

i got a query but could not identify user which perform a task.

Upvotes: 0

Views: 113

Answers (1)

Jahnavi
Jahnavi

Reputation: 7828

Use below KQL query to meet your requirements.

AzureActivity
| where ActivityStatus == "Succeeded"
| where ResourceProvider == "Microsoft.Authorization" and TenantId == "xxxx"
| extend properties = todynamic(tostring(Properties))
| extend tenantID = properties["tenantId"]
| extend subscriptionID = properties["subscriptionId"]
| extend activity = parse_json(properties["activityLogs"])
| project Caller, TenantId

Output:

enter image description here

Upvotes: 0

Related Questions