Device Deleted From Entra

AuditLogs | where TimeGenerated > ago(90d) | where OperationName == "Delete device" | where Result == "success" | extend TargetId = tostring(TargetResources[0].id) | extend Target = substring(tostring(TargetResources[0].userPrincipalName),32)//replace_string(tostring(TargetResources[0].userPrincipalName),TargetId,'') | extend DisplayName = tostring(TargetResources[0].userPrincipalName) | extend Initiator =iff(isempty(parse_json(tostring(InitiatedBy.user)).userPrincipalName),parse_json(tostring(InitiatedBy.app)).displayName,(parse_json(tostring(InitiatedBy.user)).userPrincipalName)) | extend IPAddress= parse_json(tostring(InitiatedBy.user)).ipAddress

Explanation

This KQL (Kusto Query Language) query is designed to analyze audit logs and extract specific information about successful "Delete device" operations that occurred within the last 90 days. Here's a simple breakdown of what the query does:

Data Source: It starts by looking at the AuditLogs table.
Time Filter: It filters the logs to include only those generated in the last 90 days.
Operation Filter: It further narrows down the logs to only include entries where the operation performed was "Delete device".
Result Filter: It ensures that only successful operations are considered by checking if the result was "success".
Extract Target ID: It creates a new column TargetId that extracts the ID of the target resource (device) from the first element of the TargetResources array.
Extract Target: It creates another column Target by extracting and modifying the userPrincipalName of the target resource, removing the first 32 characters.
Extract Display Name: It adds a column DisplayName that captures the userPrincipalName of the target resource.
Identify Initiator: It determines who initiated the operation. If the userPrincipalName is empty, it uses the displayName of the application that initiated the operation; otherwise, it uses the userPrincipalName of the user.
Extract IP Address: It adds a column IPAddress to capture the IP address of the user who initiated the operation.

Overall, this query is used to track and analyze successful device deletions, providing details about the target device, the initiator of the deletion, and their IP address.

Details

Jay Kerai

Released: December 2, 2025

Tables

AuditLogs

Keywords

AuditLogsTimeGeneratedOperationNameResultTargetResourcesInitiatedByUserPrincipalNameDisplayNameIPAddress

Operators

KQL Search