Edit

Share via

Queries for the AADProvisioningLogs table

  • Article

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Provisioning actions for the last week

Shows the number of users and groups created, updated, disabled, and deleted in the past 7 days.

AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, Action
| order by Type, Action

Provisioning errors

Shows the count per error code and when were they last seen.

AADProvisioningLogs
| where ResultType == "Failure"
| summarize Occurrences=count(), LastSeen=max(TimeGenerated) by ResultSignature
| order by LastSeen

Provisioned objects by day

Summarizes for each day the number of created objects per day.

AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| where Action == "Create"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, bin(TimeGenerated, 1d)
| render columnchart