Azure AD User Immutable Id Attribute Updated

Copper Contributor


I need to identify Azure AD User Immutable ID Attribute updated in Sentinel. Could you please provide KQL queries for this scenario so that I can create custom analytics rule to identify those activities?

Thanks in advance.

2 Replies
Hi Kidd, thank you for your response. I already know, but I want a KQL query for Sentinel for the scenario which I mentioned.