EntraID - Group Membership changes - Dynamic Group memberships
Entra ID Group Membershipchanges Dynamic
Query
AuditLogs
| where OperationName == "Remove member from group"
| where Category == "GroupManagement"
| where parse_json(tostring(InitiatedBy.app)).displayName == "Microsoft Approval Management"
| extend DeviceName = tostring(TargetResources[0].displayName)
| extend GroupObjectId = tostring(TargetResources[1].id)
| project TimeGenerated, OperationName, DeviceName, GroupObjectIdAbout this query
Explanation
This query is used to track changes in group membership for Entra ID Dynamic Groups. It looks for additions and removals of members from groups initiated by "Microsoft Approval Management" in both Entra ID Audit Logs and Defender for Cloud Apps logs. The query extracts information such as the time of the change, the operation name, the device name, and the group object ID or name.