KQL Search

// Time range between generation of TAP and login attempts
let logonDiff = 4h;
AuditLogs
| where LoggedByService == "Authentication Methods" and ResultDescription == "Admin registered temporary access pass method for user"
| extend TAPInitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend TAPInitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))
| extend TAPTargetUpn = tolower(tostring(TargetResources[0].userPrincipalName))
| extend TAPTargetId = tostring(TargetResources[0].id)
| project TAPGeneratedTime = TimeGenerated, UserPrincipalName = TAPTargetUpn, TAPInitiatingUserOrApp, TAPInitiatingIpAddress
| join kind= inner (
    SigninLogs
    // Error Code "130502" seems to be audited in case of "Temporary Access Pass sign in was blocked due to User Credential Policy.", no documentation available as far as I know
    | where ResultType == "130502"
    | where AuthenticationDetails contains "Temporary Access Pass"
    | project SignInAttemptTime = TimeGenerated, UserPrincipalName, SignInAttemptIPAddress = IPAddress
) on UserPrincipalName
| where TAPGeneratedTime < SignInAttemptTime and SignInAttemptTime - TAPGeneratedTime <= logonDiff
| summarize TAPGeneratedTime = max(TAPGeneratedTime), SignInAttemptTime = max(SignInAttemptTime) by UserPrincipalName, TAPInitiatingUserOrApp, SignInAttemptIPAddress
| extend timestamp = SignInAttemptTime, AccountCustomEntity = TAPInitiatingUserOrApp, IPCustomEntity = SignInAttemptIPAddress