Usage reporting for Azure Sentinel

Hi David Caddick

Group data isn't available, the connector is for logging not configuration, so even if there were log entries you may miss groups or their membership.  i.e. group created on Jan 1st, and you elected to only keep 3mths retention in your workspace  so you lose knowledge of it on 1st April.  That's why you need to check against the api or another trusted source. 

https://techcommunity.microsoft.com/t5/azure-sentinel/sign-in-logs-and-azure-ad-groups/m-p/1244996#M1213

How often are you adding Groups / memberships, perhaps a Logic app/ PS / Function  that ran 1,2,4 times a day would be sufficient to populate a csv file?


Some logging data is obtained by these EventIDs (my list so I may have missed some)

// 4727 A security-enabled global group was created. 
// 4728 A member was added to a security-enabled global group. 
// 4729 A member was removed from a security-enabled global group. 
// 4730 A security-enabled global group was deleted. 
// 4731 A security-enabled local group was created. 
// 4732 A member was added to a security-enabled local group. 
// 4733 A member was removed from a security-enabled local group. 
// 4734 A security-enabled local group was deleted. 
// 4735 A security-enabled local group was changed. 
// 4737 A security-enabled global group was changed. 
// 4754 A security-enabled universal group was created. 
// 4755 A security-enabled universal group was changed. 
// 4756 A member was added to a security-enabled universal group. 
// 4757 A member was removed from a security-enabled universal group. 
// 4758 A security-enabled universal group was deleted. 
// 4764 A groups type was changed. 

SecurityEvent
| where EventID in (4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764)
| summarize count() by EventID, Activity