Partager via

Requêtes pour la table IdentityDirectoryEvents

  • Article

Pour plus d’informations sur l’utilisation de ces requêtes dans le Portail Azure, consultez le didacticiel Log Analytics. Pour l’API REST, consultez Requête.

Modification de l’appartenance au groupe

L’appartenance au groupe a changé.

let group = '<insert your group>';
IdentityDirectoryEvents
| where ActionType == 'Group Membership changed'
| extend AddedToGroup = AdditionalFields['TO.GROUP']
| extend RemovedFromGroup = AdditionalFields['FROM.GROUP']
| extend TargetAccount = AdditionalFields['TARGET_OBJECT.USER']
| where AddedToGroup == group or RemovedFromGroup == group
| project-reorder Timestamp, ActionType, AddedToGroup, RemovedFromGroup, TargetAccount
| limit 100

Événement de modification de mot de passe

Recherchez l’événement de modification de mot de passe le plus récent pour un compte spécifique.

//Find the latest password change event for a specific account
let userAccount = '<insert your user account>';
let deviceAccount = 'insert your device account';
IdentityDirectoryEvents
| where ActionType == 'Account Password changed'
| where TargetAccountDisplayName == userAccount
//If you are looking for last password change of a device account comment the above row and remove comment from the below row
//| where TargetDeviceName == deviceAccount
| summarize LastPasswordChangeTime = max(Timestamp) by TargetAccountDisplayName // or change to TargetDeviceName for devcie account