Forum Discussion
Solved
Log with Tenant NAME, not TenantId
After searching without any success, I'm looking for help figuring out how to use KQL to get the tenant name. AuditLogs contains the TenantId field, but I need the Name (the text string that is shown...
- The TenantID column in a Workspace with KQL is actually the Workspace ID (look at your Workspace Settings). There is a AAD tenantID value in the Auditlogs as well
As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?
// this has both GUIDs but no name either
UserPeerAnalytics
| project AADTenantId, TenantId
The TenantID column in a Workspace with KQL is actually the Workspace ID (look at your Workspace Settings). There is a AAD tenantID value in the Auditlogs as well
As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?
// this has both GUIDs but no name either
UserPeerAnalytics
| project AADTenantId, TenantId
As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?
// this has both GUIDs but no name either
UserPeerAnalytics
| project AADTenantId, TenantId