KQL Search

Query Details

Audit Logs Cross Tenant Access Settings Modified

Query

AuditLogs
| where Category == "CrossTenantAccessSettings" or OperationName has "cross-tenant"
| extend
    Initiator = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["displayName"]), tostring(InitiatedBy["user"]["userPrincipalName"])),
    InitiatorId = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["servicePrincipalId"]), tostring(InitiatedBy["user"]["id"])),
    IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"])
| project
    TimeGenerated,
    Category,
    Initiator,
    IPAddress,
    OperationName,
    Result,
    InitiatedBy,
    AdditionalDetails,
    TargetResources,
    LoggedByService,
    InitiatorId,
    CorrelationId

Explanation

This query is searching through audit logs for entries where the category is "CrossTenantAccessSettings" or the operation name includes "cross-tenant". It then creates new columns for the initiator (either an app or a user), the initiator's ID, and the IP address associated with the initiator.

The query then selects and displays the following information: the time the log was generated, the category, the initiator, the IP address, the operation name, the result, who initiated the action, any additional details, the target resources, the service that logged the action, the initiator's ID, and the correlation ID.