Summary Rules - Entra Assigned Roles Report

IdentityInfo | summarize arg_max(TimeGenerated, *) by AccountObjectId | mv-expand AssignedRoles | where isnotempty(AssignedRoles) | summarize TotalRoles = dcount(tostring(AssignedRoles)), Roles = make_set(tostring(AssignedRoles), 100) by AccountObjectId, AccountDisplayName, AccountUPN | extend ReportDate = now()

Query Information

Description

This summary rule focusses on the assigned roles of users. The results of the summary rule can again be used to get insights into specific users, to for example see if their roles increase or decrease overtime. These results can also serve as input for reporting on role assignments.

Recommended Schedule: 24 hours.

Recommended Delay: 60 minutes.

References

Explanation

This query is designed to generate a report on the roles assigned to users within an organization. Here's a simplified breakdown of what the query does:

Data Source: It starts by accessing the IdentityInfo table, which contains information about user identities.
Latest Record Selection: It uses summarize arg_max(TimeGenerated, *) by AccountObjectId to select the most recent record for each user, identified by AccountObjectId.
Role Expansion: The mv-expand AssignedRoles step breaks out the list of roles assigned to each user into individual entries, making it easier to work with each role separately.
Filter Non-Empty Roles: It filters out any entries where the AssignedRoles field is empty, ensuring that only users with assigned roles are considered.
Role Counting and Listing: The query then summarizes the data to count the total number of distinct roles (TotalRoles) each user has and creates a list of these roles (Roles). This is done for each user, identified by their AccountObjectId, AccountDisplayName, and AccountUPN.
Report Date: Finally, it adds a ReportDate field with the current date and time, indicating when the report was generated.

The query is recommended to run every 24 hours with a 60-minute delay to ensure the data is up-to-date. This report can be used to monitor changes in user roles over time and assist in role assignment reporting.

KQL Search