Identity Guest Invites Sentvs Redeemed
Query
//Visualizes the total guest invites sent from your Azure AD tenant vs those redeemed. Data is summarized per week.
//Data connector required for this query - Azure Active Directory - Audit Logs
let timerange=180d;
AuditLogs
| where TimeGenerated > ago (timerange)
| where OperationName in ("Redeem external user invite", "Invite external user")
| summarize
InvitesSent=countif(OperationName == "Invite external user"),
InvitesRedeemed=countif(OperationName == "Redeem external user invite")
by startofweek(TimeGenerated)
| render columnchart
with (
title="Guest Invites Sent v Guest Invites Redeemed",
xtitle="Invites",
kind=unstacked)Explanation
This query visualizes the total number of guest invites sent from your Azure AD tenant compared to the number of invites that have been redeemed. The data is summarized on a weekly basis. To run this query, you need to use the Azure Active Directory - Audit Logs data connector. The query calculates the count of invites sent and invites redeemed and groups them by the start of each week. The result is then displayed as a column chart, showing the comparison between guest invites sent and guest invites redeemed.
Details
Matt Zorich
Released: June 17, 2022
Tables
AuditLogs
Keywords
Keywords: Azure ADAudit LogsTimeGeneratedOperationNameRedeem external user inviteInvite external userInvitesSentInvitesRedeemedstartofweekrender columncharttitlextitlekind
Operators
lettimerange=180dAuditLogswhereTimeGenerated>ago(timerange)OperationNamein("Redeem external user invite""Invite external user")summarizeInvitesSent=countif(OperationName == "Invite external user")InvitesRedeemed=countif(OperationName == "Redeem external user invite")bystartofweek(TimeGenerated)rendercolumnchartwith(title="Guest Invites Sent v Guest Invites Redeemed"xtitle="Invites"kind=unstacked)