KQL Search

This query is analyzing audit logs to identify users who have attempted to change their passwords through self-service but failed because their new passwords did not comply with the fuzzy policy. Here's a breakdown of what the query does:

1. Filter for Specific Operation: It looks for log entries where the operation name is "Change password (self-service)".

2. Filter for Specific Result: It further filters these entries to only include those where the result description is "PasswordDoesnotComplyFuzzyPolicy", indicating the password change attempt failed due to non-compliance with the policy.

3. Extract User Information: It extracts the user's principal name (essentially their username or email) from the log entry and assigns it to a new column called "User".

4. Count Attempts by User: It counts how many times each user has encountered this specific failure.

5. Filter for Multiple Failures: Finally, it filters the results to only include users who have failed more than once, allowing you to focus on users who might need additional assistance or guidance.

The comment "//use to tune threshold" suggests that the threshold for the number of failures (currently set to more than one) can be adjusted based on specific needs or criteria.