MDI - Identify Service Account OU

MDI Identify Service Account O Us

Query

let OUPattern = @"^(CN=[^,]+,)?(.+)$";
IdentityInfo
| project AccountName, AccountDisplayName, DistinguishedName
| extend OU = extract(OUPattern, 2, DistinguishedName)
| project-rename DistinguishedName
| where OU contains "service"
| distinct OU

About this query

MDI - Identify Service Account OU

Query Information

Description

This KQL query is designed to identify accounts in Microsoft Defender for Identity whose Organizational Unit (OU) in Active Directory contains the word "service." It extracts the OU from the DistinguishedName field and filters for accounts where the OU name includes "service," helping to pinpoint service accounts within the directory.

References

Author

Alex Verboon

Defender XDR

IdentityInfo
| summarize arg_max(Timestamp,*) by AccountName
| project AccountName, DistinguishedName
| extend OUPath = extract(@"CN=[^,]+,(.*)", 1, DistinguishedName)
| where OUPath contains "OU=ServiceAccounts"
| distinct OUPath

Explanation

This KQL query is designed to find and list service accounts in Microsoft Defender for Identity by examining their Organizational Unit (OU) in Active Directory. Here's a simplified breakdown of what the query does:

Pattern Definition: It defines a pattern to extract the OU part from the DistinguishedName field of accounts.
Data Extraction: It retrieves account information such as AccountName, AccountDisplayName, and DistinguishedName from the IdentityInfo table.
OU Extraction: It extracts the OU from the DistinguishedName using the defined pattern.
Filtering: It filters the accounts to only include those where the OU name contains the word "service."
Distinct OUs: It lists distinct OUs that contain the word "service."
Latest Account Info: It summarizes the latest information for each account by AccountName.
OU Path Extraction: It extracts the OU path from the DistinguishedName for accounts where the OU path includes "OU=ServiceAccounts."
Distinct OU Paths: It lists distinct OU paths that match the criteria.

Overall, this query helps identify and list service accounts by focusing on their organizational unit names in Active Directory, specifically looking for those related to service accounts.

Details

Alex Verboon

Released: December 22, 2025

Tables

IdentityInfo

Keywords

MicrosoftDefenderIdentityActiveDirectoryServiceAccountsOrganizationalUnitInfoAccountNameDistinguishedTimestamp

Operators

letprojectextendextractproject-renamewheredistinctsummarizearg_max

Actions

GitHub

KQL Search