KQL Search

// Query all users that habe the "Directory Synchronization Accounts" role assigned
let DirSyncRoleAssignedMembers = (IdentityInfo
    | where TimeGenerated > ago(14d)
    | summarize arg_max(TimeGenerated, *) by AccountObjectId
    | where AssignedRoles has "Directory Synchronization Accounts"
    | summarize by AccountObjectId);
// Query all users that have signed in to the AADSync API
let DirSyncNamedUsers = (union isfuzzy=true AADNonInteractiveUserSignInLogs, SigninLogs
    | where TimeGenerated > ago(1d)
    // AADC APIs: AADSync = "cb1056e2-e479-49de-ae31-7812af012ed8", AAD Connect v2 = 6eb59a73-39b2-4c23-a70f-e2e3ce8965b1
    | where (UserPrincipalName startswith "sync_" and UserPrincipalName endswith "onmicrosoft.com")
        or AppId == "cb1056e2-e479-49de-ae31-7812af012ed8"
        or AppId == "6eb59a73-39b2-4c23-a70f-e2e3ce8965b1"
    | summarize by AccountObjectId = UserId);
// Query all explicitly tagged Microsoft Entra Connect / Azure AD Connect account in the watchlist ServiceAccounts
let WatchList = _GetWatchlist('ServiceAccounts')
    | where ['Tags'] has "Azure AD Connect"
    | project AccountObjectId = ['Service AAD Object Id'];
// Combine the two lists and remove all known accounts
// All resulting accounts are not possibly not allowed to use this API or have the role assigned
union isfuzzy=true DirSyncRoleAssignedMembers, DirSyncNamedUsers
| summarize by AccountObjectId
| where AccountObjectId !in (WatchList)
| join kind=leftouter (IdentityInfo
    | where TimeGenerated > ago(14d)
    | summarize arg_max(TimeGenerated, *) by AccountObjectId
    )
    on AccountObjectId
| project-away *1, TimeGenerated