microsoft · Expecho · Mar 8, 2024 · Mar 8, 2024 · Mar 8, 2024 · May 2, 2024
diff --git a/...Azure Active Directory Logs/Alerts/README → ...ces/Microsoft Entra ID Logs/Alerts/README b/...Azure Active Directory Logs/Alerts/README → ...ces/Microsoft Entra ID Logs/Alerts/README
diff --git a/...oft Entra ID Logs/Queries/Audit/Priviliged Identity Management requests and approvals.kql b/...oft Entra ID Logs/Queries/Audit/Priviliged Identity Management requests and approvals.kql
@@ -0,0 +1,31 @@
+// Author: Expecho
+// Display name: Privileged Identity Management activations and approvals
+// Description: View Privileged Identity Management role activations and approvals
+// Categories: Audit
+// Resource types: Microsoft Entra ID
+// Topic: Audit
+
+AuditLogs
+| where TimeGenerated > ago(30d)
+| where LoggedByService == "PIM"
+| where OperationName == "Add member to role completed (PIM activation)"
+| project 
+    TimeGenerated, 
+    Reason = ResultReason, 
+    Result, 
+    Requestor = Identity, 
+    Category,
+    Role = tostring(TargetResources[0].displayName), 
+    ResourceName = tostring(TargetResources[3].displayName), 
+    ResourceType = tostring(TargetResources[3].type), 
+    Start = iif(Category == "GroupManagement", todatetime(AdditionalDetails[2].value), todatetime(AdditionalDetails[3].value)),
+    End = iif(Category == "GroupManagement", todatetime(AdditionalDetails[3].value), todatetime(AdditionalDetails[4].value)), 
+    CorrelationId
+| join kind=leftouter  (
+    AuditLogs
+        | where TimeGenerated > ago(30d)
+        | where LoggedByService == "PIM"
+        | where OperationName == "Add member to role request approved (PIM activation)"
+        | project CorrelationId, Approval = ResultDescription, Approver = Identity, Approved = Result) 
+    on CorrelationId
+| distinct TimeGenerated, Requestor, Reason, Approver, Approval, Category, Role, ResourceName, ResourceType, Start, End
diff --git a/...ries/Audit/Provisioned objects by day.kql → ...ries/Audit/Provisioned objects by day.kql b/...ries/Audit/Provisioned objects by day.kql → ...ries/Audit/Provisioned objects by day.kql
diff --git a/...rovisioning actions for the last week.kql → ...rovisioning actions for the last week.kql b/...rovisioning actions for the last week.kql → ...rovisioning actions for the last week.kql
diff --git a/...ogs/Queries/Audit/Provisioning errors.kql → ...ogs/Queries/Audit/Provisioning errors.kql b/...ogs/Queries/Audit/Provisioning errors.kql → ...ogs/Queries/Audit/Provisioning errors.kql
diff --git a/.../Security/Inactive Service Principals.kql → .../Security/Inactive Service Principals.kql b/.../Security/Inactive Service Principals.kql → .../Security/Inactive Service Principals.kql
diff --git a/...ies/Security/Most active IP Addresses.kql → ...ies/Security/Most active IP Addresses.kql b/...ies/Security/Most active IP Addresses.kql → ...ies/Security/Most active IP Addresses.kql
diff --git a/...curity/Most active Managed Identities.kql → ...curity/Most active Managed Identities.kql b/...curity/Most active Managed Identities.kql → ...curity/Most active Managed Identities.kql
diff --git a/...curity/Most active Service Principals.kql → ...curity/Most active Service Principals.kql b/...curity/Most active Service Principals.kql → ...curity/Most active Service Principals.kql
diff --git a/...s/Security/Users with multiple cities.kql → ...s/Security/Users with multiple cities.kql b/...s/Security/Users with multiple cities.kql → ...s/Security/Users with multiple cities.kql
diff --git a/...re Active Directory Logs/Workbooks/README → .../Microsoft Entra ID Logs/Workbooks/README b/...re Active Directory Logs/Workbooks/README → .../Microsoft Entra ID Logs/Workbooks/README
diff --git a/...ices/Azure Active Directory/Alerts/README → ...Services/Microsoft Entra ID/Alerts/README b/...ices/Azure Active Directory/Alerts/README → ...Services/Microsoft Entra ID/Alerts/README
diff --git a/...ces/Azure Active Directory/Queries/README → ...ervices/Microsoft Entra ID/Queries/README b/...ces/Azure Active Directory/Queries/README → ...ervices/Microsoft Entra ID/Queries/README
diff --git a/...s/Azure Active Directory/Workbooks/README → ...vices/Microsoft Entra ID/Workbooks/README b/...s/Azure Active Directory/Workbooks/README → ...vices/Microsoft Entra ID/Workbooks/README