KQL Search

Query Details

HomeAI ToolsDevice Query

Identity Guest Invites Sentvs Redeemed

Query

//Visualizes the total guest invites sent from your Azure AD tenant vs those redeemed. Data is summarized per week.

//Data connector required for this query - Azure Active Directory - Audit Logs

let timerange=180d;
AuditLogs
| where TimeGenerated > ago (timerange)
| where OperationName in ("Redeem external user invite", "Invite external user")
| summarize
    InvitesSent=countif(OperationName == "Invite external user"),
    InvitesRedeemed=countif(OperationName == "Redeem external user invite")
    by startofweek(TimeGenerated)
| render columnchart
    with (
    title="Guest Invites Sent v Guest Invites Redeemed",
    xtitle="Invites",
    kind=unstacked)

Explanation

This query visualizes the total number of guest invites sent from your Azure AD tenant compared to the number of invites that have been redeemed. The data is summarized on a weekly basis. To run this query, you need to use the Azure Active Directory - Audit Logs data connector. The query calculates the count of invites sent and invites redeemed and groups them by the start of each week. The result is then displayed as a column chart, showing the comparison between guest invites sent and guest invites redeemed.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 17, 2022

Tables

AuditLogs

Keywords

Keywords:AzureAD,AuditLogs,TimeGenerated,OperationName,Redeemexternaluserinvite,Inviteexternaluser,InvitesSent,InvitesRedeemed,startofweek,rendercolumnchart,title,xtitle,kind

Operators

lettimerange=180dAuditLogswhereTimeGenerated>ago(timerange)OperationNamein("Redeem external user invite""Invite external user")summarizeInvitesSent=countif(OperationName == "Invite external user")InvitesRedeemed=countif(OperationName == "Redeem external user invite")bystartofweek(TimeGenerated)rendercolumnchartwith(title="Guest Invites Sent v Guest Invites Redeemed"xtitle="Invites"kind=unstacked)

Actions