KQL Search

Query Details

Entra ID - Microsoft Entra Connect Sync Audit Events

Entra ID Entra Connect Sync Audit Events

Query

SecurityEvent
| where EventSourceName == "Entra Connect Admin Actions"
| extend xml = parse_xml(tostring(EventData))
| extend data_text = coalesce(
        tostring(xml.EventData.Data),
        tostring(xml["EventData"]["Data"]["#text"])
    )
| where isnotempty(data_text)
| extend j = todynamic(data_text)
| extend
    ActionType      = tostring(j.ActionType),
    AuditEventType  = tostring(j.AuditEventType),
    Category        = tostring(j.Category),
    Name            = tostring(j.Name),
    Status          = tostring(j.Status),
    EventJsonTime   = tostring(j.Timestamp),
    User            = tostring(j.User),
    Details         = tostring(j.Details)
| project TimeGenerated, EventID, Name, ActionType, Status, User, EventJsonTime, Details
| order by TimeGenerated desc

About this query

Explanation

This query is designed to analyze audit logs from Microsoft Entra Connect Sync, specifically focusing on administrative actions. Here's a simplified breakdown of what the query does:

  1. Data Source: It looks at security events where the source is "Entra Connect Admin Actions."

  2. Event Filtering: It filters events based on specific Event IDs that are related to administrative actions. These IDs are specified in the query to capture relevant events.

  3. XML Parsing: The query extracts and parses XML data from the event logs to make it easier to work with.

  4. Data Extraction: It extracts specific fields from the parsed data, such as:

    • ActionType: The type of action performed.
    • AuditEventType: The type of audit event.
    • Category: The category of the event.
    • Name: The name associated with the event.
    • Status: The status of the action.
    • EventJsonTime: The timestamp of the event.
    • User: The user who performed the action.
    • Details: Additional details about the event.

  5. Output: The query projects (selects) these fields along with the time the event was generated and the Event ID.

  6. Sorting: Finally, it sorts the results by the time the event was generated, in descending order, so the most recent events appear first.

This query is useful for monitoring and auditing administrative actions in Microsoft Entra Connect Sync, helping administrators track changes and actions taken within the system.

Details

Alex Verboon profile picture

Alex Verboon

Released: September 6, 2025

Tables

SecurityEvent

Keywords

EntraConnectSyncAuditLogsEventLogAnalyticsWorkspaceWindowsSecurityDataConnectorCollectionRuleEventsSecurityEventEventSourceNameEventDataActionTypeAuditEventTypeCategoryNameStatusEventJsonTimeUserDetailsTimeGeneratedEventID

Operators

Application!*SystemProvider@NameandEventIDorSecurityEvent|where==extendparse_xmltostringcoalesceisnotemptytodynamicprojectorder bydesc

Actions

GitHub