Assignment Of Local Administrator Entra Role
Query
//Assignment of Local Administrator Entra Role /Device administrator Role
// Best Practice is to assign a LAPS Reader role (Custom) instead and assign to an admin unit
AuditLogs
| where ActivityDisplayName == "Add member to role"
| where parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue contains "Device Local Administrator" or (parse_json(tostring(TargetResources[0].modifiedProperties))[3].newValue) == "\"DeviceAdministrators\""
//| where parse_json(tostring(TargetResources[1].administrativeUnits)) == "[]" //if you want to Include only tenant wide assignmentsExplanation
This query is designed to monitor and identify specific role assignments related to device administration within an organization. Here's a simplified breakdown:
-
Source of Data: The query is examining logs from
AuditLogs, which track various activities within the system. -
Activity Filter: It focuses on the activity where a member is added to a role, specifically filtering for the activity named "Add member to role".
-
Role Assignment Check: The query checks if the new role assigned is either "Device Local Administrator" or "DeviceAdministrators". This is done by parsing the
modifiedPropertiesof theTargetResourcesto identify these specific roles. -
Best Practice Note: The comments suggest that instead of assigning these roles directly, it's better to assign a custom role called "LAPS Reader" and associate it with an admin unit. This is considered a best practice for managing local administrator privileges.
-
Optional Filter: There's a commented-out line that, if activated, would filter the results to include only those assignments that are tenant-wide, meaning they are not restricted to any specific administrative unit.
In summary, the query is used to track when users are added to specific device administration roles, with a recommendation to use a more secure and controlled approach by assigning a custom role instead.
Details
Jay Kerai
Released: August 20, 2025
Tables
Keywords
Operators