Forum Discussion

Dean_Gross's avatar
Dean_Gross
Silver Contributor
Sep 21, 2022

Log with Tenant NAME, not TenantId

After searching without any success, I'm looking for help figuring out how to use KQL to get the tenant name. AuditLogs contains the TenantId field, but I need the Name (the text string that is shown in the basics section of the Azure AD portal. 

 

This should be simple, and I'm sure I'm just being dense this morning, but I can't figure it out. Can anyone tell me how to get this information?

  • The TenantID column in a Workspace with KQL is actually the Workspace ID (look at your Workspace Settings). There is a AAD tenantID value in the Auditlogs as well

    As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?

    // this has both GUIDs but no name either
    UserPeerAnalytics
    | project AADTenantId, TenantId
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    The TenantID column in a Workspace with KQL is actually the Workspace ID (look at your Workspace Settings). There is a AAD tenantID value in the Auditlogs as well

    As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?

    // this has both GUIDs but no name either
    UserPeerAnalytics
    | project AADTenantId, TenantId

Resources