Azure AD User Immutable Id Attribute Updated

Question

Hi,I need to identify Azure AD User Immutable ID Attribute updated in Sentinel. Could you please provide KQL queries for this scenario so that I can create custom analytics rule to identify those activities?Thanks in advance.

kidd_ip · Answer

Dharshan_N&nbsp;&nbsp;Find a similar post but to Splunk:&nbsp;https://research.splunk.com/cloud/0c0badad-4536-4a84-a561-5ff760f3c00e/&nbsp;

dharshan_n · Answer

Hi Kidd, thank you for your response. I already know, but I want a KQL query for Sentinel for the scenario which I mentioned.

Forum Discussion

Azure AD User Immutable Id Attribute Updated

Share

Resources