Forum Discussion
Azure AD detection User added to group vs User added to role
AnuragSrivastava do you know how I make a distinction between groups and roles?
ceesmandjes if you wish to list out the for roles & groups, then the appropriate operation names are 'Add member to role', 'Add member to group'.
You can tweak the template rule which is mentioned above by adding these to the list, something like below (Note that, below is just a few first lines from default template rule as an example)
let timeframe = 1h;
let OperationList = dynamic(["Add member to role", "Add member to role", "Add member to group" ,"Add member to role in PIM requested (permanent)"]);
let PrivilegedGroups = dynamic(["UserAccountAdmins","PrivilegedRoleAdmins","TenantAdmins"]);
AuditLogs
| where TimeGenerated >= ago(timeframe)
| where LoggedByService =~ "Core Directory"