MicrosoftGraphActivityLogs User Enrichment
User Enrichment
Query
MicrosoftGraphActivityLogs
| where isnotempty(UserId)
| lookup kind=leftouter (IdentityInfo
| where TimeGenerated > ago(30d)
| summarize arg_max(TimeGenerated, *) by AccountObjectId
| project AccountObjectId, AccountDisplayName, AccountUpn)
on $left.UserId == $right.AccountObjectId
| project-reorder AccountDisplayName, AccountUpn, RequestMethod, RequestUriAbout this query
MicrosoftGraphActivityLogs User Enrichment
Query Information
Description
This query enriches the MicrosoftGraphActivityLogs with userinformation from the IdentityInfo table to get more context in the results.
References
- https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview#what-data-is-available-in-the-microsoft-graph-activity-logs
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-identityinfo-table?view=o365-worldwide
- https://kqlquery.com/posts/graphactivitylogs/
Sentinel
Explanation
This query is designed to enhance the data from the Microsoft Graph Activity Logs by adding user information from another table called IdentityInfo. Here's a simple breakdown of what the query does:
-
Filter Activity Logs: It starts by selecting entries from the Microsoft Graph Activity Logs where the UserId field is not empty. This ensures that only logs associated with a user are considered.
-
Enrich with User Information: It performs a left outer join with the IdentityInfo table to add more details about the user. This is done by matching the UserId from the activity logs with the AccountObjectId from the IdentityInfo table.
-
Recent User Data: From the IdentityInfo table, it only considers records generated in the last 30 days. It selects the most recent entry for each user (using
arg_maxto get the latest information based on the TimeGenerated field). -
Select Relevant User Details: It retrieves specific user details like AccountDisplayName and AccountUpn (User Principal Name) from the IdentityInfo table.
-
Reorder Columns: Finally, it rearranges the columns in the output to prioritize the display of user information (AccountDisplayName and AccountUpn) followed by request details (RequestMethod and RequestUri).
Overall, this query provides a more comprehensive view of user activities by combining log data with enriched user information.
Details
Bert-Jan Pals
Released: August 14, 2025
Tables
Keywords
Operators