KQL Search

//Detects users who have added a credential to an Azure AD App for the first time in 90 days, adjust timeframe as needed.

//Data connector required for this query - Azure Active Directory - Audit Logs

let timeframe = startofday(ago(90d));
AuditLogs
| where TimeGenerated > timeframe and TimeGenerated < startofday(now())
| where OperationName has "Update application – Certificates and secrets management"
| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| project Actor
| join kind=rightanti
    (
    AuditLogs
    | where TimeGenerated > startofday(now())
    | where OperationName has "Update application – Certificates and secrets management"
    | extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
    | extend AppId = tostring(AdditionalDetails[1].value)
    | project TimeGenerated, Actor, AppId
    )
    on Actor
| project TimeGenerated, Actor, AppId