Entra ID - User Risk - On Premises Password Change
Azure AD User Risk On Premise Password Change
Query
AuditLogs
| where OperationName == "Change user password"About this query
Explanation
This query is used to identify users who have remediated their User Risk through an on-premises password change. It looks for audit logs of the "Change user password" operation and the "Update StsRefreshTokenValidFrom Timestamp" operation. When the "Allow on-premises password change to reset user risk" setting is enabled, it also looks for AADUserRiskEvents with the RiskDetail "userChangedPasswordOnPremises".
Details
Alex Verboon
Released: November 2, 2023
Tables
AuditLogs
AADUserRiskEvents
Keywords
DevicesIntuneUserOn-premises Password Change
Operators
whereOperationName=="Change user password"
where"Update StsRefreshTokenValidFrom Timestamp"
whereRiskDetail"userChangedPasswordOnPremises"