Multiple Unexpected Azure AD Device

Explanation

This query is designed to monitor and analyze device-related activities in an Azure Active Directory (Azure AD) environment. It checks for device addition or deletion events within a specified time frame (1 hour by default) and over a specified period (14 days by default).

The query also checks for specific types of trust relationships (Workplace, AzureAd, ServerAd), device management apps (like Microsoft Intune), and group tags in Microsoft Intune.

It then collects and organizes information about these events, including the time they occurred, the type of operation (add, delete, update), the user or app that initiated the operation, the result, and any additional details.

The query also checks for any sign-in events related to the devices and includes this information in the final output.

The output is sorted by device ID and the time the event occurred, and includes a wide range of details about each event. This can help administrators track and analyze device-related activities in their Azure AD environment.

Details

Jose Sebastián Canós

Released: March 24, 2023

Tables

AuditLogsIdentityInfoSigninLogsAADNonInteractiveUserSignInLogs

Keywords

TimeDeviceTrustTypeWorkplaceAzureAdServerAdActivityAzureADTrustTypeDeviceManagementActorIdIntuneOrderIdAADADSyncActorPrincipalNameIdentityInfoAccountObjectIdAccountUPNMailAddressAdditionalMailAddressesAuditLogsCategoryCore DirectoryAADOperationTypeResultDescriptionObjectIdDeviceNameInitiatedByUserInitiatedByAppOperationNameResultAdditionalDetailsCorrelationIdAutopilotZTDIDUserPrincipalNameIntuneAzureResourceIdSigninLogsIPAddressResourceDisplayNameAppDisplayName

Operators

toscalar()arg_max()count()mv-expandmake_list()wheresummarizeprojectextendextract()lookupmake_set()take_any()take_anyif()unionmaterialize()project-awayproject-renamesortproject-reorder.

KQL Search