Entra ID - Administrative Units

Query

let monitoredOperations = dynamic([
    "Add member to administrative unit",
    "Add member to role scoped over Restricted Management Administrative Unit",
    "Remove member from role scoped over Restricted Management Administrative Unit",
    "Add member to restricted management administrative unit",
    "Remove member from restricted management administrative unit"
]);
AuditLogs
| where OperationName in~ (monitoredOperations)

About this query

Explanation

This query is designed to monitor specific activities related to Administrative Units in Microsoft Entra ID, which is part of Azure Active Directory. The query focuses on tracking certain operations that involve adding or removing members from administrative units or roles within these units, especially those with restricted management capabilities.

Here's a simplified breakdown of what the query does:

Monitored Operations: The query defines a list of specific operations to monitor. These operations include:
- Adding a member to an administrative unit.
- Adding or removing a member from a role that is scoped over a Restricted Management Administrative Unit.
- Adding or removing a member from a restricted management administrative unit.
Data Sources:
- AuditLogs: This part of the query checks the Entra ID Audit logs to find any of the specified operations.
- CloudAppEvents: This part of the query checks events from the Defender for Cloud Apps Connector for the same operations, noting that the action type names have a trailing period.
Purpose: The query is used to detect and monitor changes in administrative units, particularly those that could affect the security and management of privileged users and groups. This is crucial for maintaining security and compliance within an organization's Azure environment.

Overall, the query helps administrators keep track of important changes in administrative units, ensuring that any unauthorized or suspicious activities are quickly identified and addressed.

KQL Search