how to identify Inactive AAD groups?

%3CLINGO-SUB%20id%3D%22lingo-sub-3459502%22%20slang%3D%22en-US%22%3Ehow%20to%20identify%20Inactive%20AAD%20groups%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3459502%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EHello%20everyone%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3Ehow%20to%20identify%20Inactive%20AAD%20groups%3F%20O%20where%20can%20I%20find%20the%20logs%20about%20this%20issue%3F%20there%20is%20any%20query%20o%20automation%20we%20can%20used%20in%20sentinel%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Ethank%20you%20very%20much%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3459502%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAnalytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EKQL%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESIEM%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3476232%22%20slang%3D%22en-US%22%3ERe%3A%20how%20to%20identify%20Inactive%20AAD%20groups%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3476232%22%20slang%3D%22en-US%22%3EHow%20would%20you%20define%20an%20%22Inactive%20AAD%20group%22%3F%3C%2FLINGO-BODY%3E
Occasional Visitor

Hello everyone

how to identify Inactive AAD groups? O where can I find the logs about this issue? there is any query o automation we can used in sentinel

 

thank you very much

1 Reply
How would you define an "Inactive AAD group"?