KQL Search

// Function to get privileged users from IdentityInfo and privileged workloads from WorkloadIdentityInfo
let SensitiveEntraDirectoryRoles = externaldata(RoleName: string, RoleId: string, isPrivileged: bool, Classification: dynamic)["https://raw.githubusercontent.com/Cloud-Architekt/AzurePrivilegedIAM/main/Classification/Classification_EntraIdDirectoryRoles.json"] with(format='multijson')
| where Classification.EAMTierLevelName != "Unclassified"
| project RoleName, isPrivileged, Classification;
let SensitiveUsers = IdentityInfo
| where TimeGenerated > ago(14d)
| summarize arg_max(TimeGenerated, *) by AccountObjectId
| mv-expand AssignedRoles
| extend RoleName = tostring(AssignedRoles)
| join kind=inner ( SensitiveEntraDirectoryRoles ) on RoleName
| summarize Classification = make_set(parse_json(Classification.EAMTierLevelName)), RoleAssignments = make_set(RoleName) by AccountObjectId, AccountDisplayName, OnPremisesAccountObjectId;
let PrivilegedUsers = SensitiveUsers
| extend OnPremSynchronized = iff(isnotempty(OnPremisesAccountObjectId), "true", "false")
| project
    ObjectId = tostring(AccountObjectId),
    ObjectType = "User",
    ObjectDisplayName = AccountDisplayName,
    OnPremSynchronized,
    tostring(Classification),
    EntraIdRoles = RoleAssignments;
let PrivilegedWorkloads = WorkloadIdentityInfo
| where isnotempty(EntraIdRoles) or isnotempty(AppRolePermissions)
| project
    ObjectId = tostring(ServicePrincipalObjectId),
    ObjectType = WorkloadIdentityType,
    ObjectDisplayName = WorkloadIdentityName,
    OnPremSynchronized = "false",
    Classification = tostring(EnterpriseAccessModelTiering),
    EntraIdRoles = EntraIdRoles,
    AppRoles = AppRolePermissions;
union PrivilegedUsers, PrivilegedWorkloads