Delete Role Assignment

%3CLINGO-SUB%20id%3D%22lingo-sub-1632643%22%20slang%3D%22en-US%22%3EDelete%20Role%20Assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1632643%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3EWe%20have%20received%20an%20Azure%20activity%20logs%20in%20which%20the%20Operation%20Name%20is%20Delete%20role%20assignment%20and%20the%20Event%20initiated%20by%20is%20MS-PIM.%3C%2FP%3E%3CP%3EIn%20which%20case%20the%20role%20is%20deleted%20by%20%22MS-PIM%22%20and%20what's%20the%20reason%20for%20deletion.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eand%20also%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20we%20tried%20to%20fetch%20the%20logs%20through%20Log%20Analytics%20the%20Caller%20was%20some%20hexadecimal%20string%2C%20so%20is%20there%20a%20way%20to%20resolve%20that%20to%20the%20user%20name%20with%20log%20analytics%20query.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1632643%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPIM%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

Hi All,

We have received an Azure activity logs in which the Operation Name is Delete role assignment and the Event initiated by is MS-PIM.

In which case the role is deleted by "MS-PIM" and what's the reason for deletion.

 

and also,

 

When we tried to fetch the logs through Log Analytics the Caller was some hexadecimal string, so is there a way to resolve that to the user name with log analytics query.

0 Replies