Audit Entra Application Management Modifications To Password Restrictions

Query

AuditLogs
| where OperationName == "Update policy" //"Add Policy" for new policies
| where TargetResources[0].displayName == "ApplicationManagementPolicy"
| mv-expand TargetResources
| mv-expand ModifiedProperties = TargetResources.modifiedProperties
| where ModifiedProperties.displayName == "PolicyDetail"
| extend NewPolicy = parse_json(tostring(parse_json(tostring(ModifiedProperties.newValue))[0]))
| extend OldPolicy = parse_json(tostring(parse_json(tostring(ModifiedProperties.oldValue))[0]))
| extend NewPwd = parse_json(
        tostring(
            parse_json(tostring(NewPolicy.ServicePrincipalRestrictions)).PasswordCredentials
        ))
| extend OldPwd = parse_json(
        tostring(
            parse_json(tostring(OldPolicy.ServicePrincipalRestrictions)).PasswordCredentials
        ))
| where tostring(NewPwd.PasswordAddition.State) != tostring(OldPwd.PasswordAddition.State)
    or tostring(NewPwd.CustomPasswordAddition.State) != tostring(OldPwd.CustomPasswordAddition.State)
    or tostring(NewPwd.SymmetricKeyAddition.State) != tostring(OldPwd.SymmetricKeyAddition.State)
| project
    TimeGenerated,
    OldPasswordAddition = tostring(OldPwd.PasswordAddition.State),
    NewPasswordAddition = tostring(NewPwd.PasswordAddition.State),
    OldCustomPasswordAddition = tostring(OldPwd.CustomPasswordAddition.State), //1 = Custom Passwords blocked.
    NewCustomPasswordAddition = tostring(NewPwd.CustomPasswordAddition.State), // 2 = off, 1 = on
    OldSymmetricKeyAddition = tostring(OldPwd.SymmetricKeyAddition.State),
    NewSymmetricKeyAddition = tostring(NewPwd.SymmetricKeyAddition.State), InitiatedBy
    //ref https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal

Explanation

This KQL (Kusto Query Language) query is designed to analyze audit logs related to policy updates, specifically focusing on changes in application management policies. Here's a simplified breakdown of what the query does:

Filter for Policy Updates: It starts by filtering the audit logs to only include entries where the operation was "Update policy" and the target resource is "ApplicationManagementPolicy".
Expand Target Resources: It expands the TargetResources array to work with each resource individually.
Extract Modified Properties: It further expands the modifiedProperties of each target resource to examine changes.
Focus on Policy Details: The query specifically looks for changes in the "PolicyDetail" property.
Parse New and Old Policy Details: It extracts and parses the new and old values of the policy details into JSON objects for easier manipulation.
Extract Password Credentials: From these JSON objects, it extracts details about password credentials under ServicePrincipalRestrictions.
Identify Changes in Password States: The query checks if there are any changes in the states of PasswordAddition, CustomPasswordAddition, or SymmetricKeyAddition between the old and new policies.
Project Relevant Information: Finally, it selects and displays relevant information such as the time of the change, the old and new states of the password-related settings, and who initiated the change.

In essence, this query is used to track changes in password-related settings within application management policies, highlighting any modifications to how passwords and keys are managed for service principals.