Log with Tenant NAME, not TenantId

[Dean Gross]

After searching without any success, I'm looking for help figuring out how to use KQL to get the tenant name. AuditLogs contains the TenantId field, but I need the Name (the text string that is shown in the basics section of the Azure AD portal. 

This should be simple, and I'm sure I'm just being dense this morning, but I can't figure it out. Can anyone tell me how to get this information?

[#2 · Accepted solution]

The TenantID column in a Workspace with KQL is actually the Workspace ID (look at your Workspace Settings). There is a AAD tenantID value in the Auditlogs as well

As far as I know its not achievable in KQL (you can do this in a Workbook using ARG and KQL), or with a Playbook to populate a Table that holds data as a lookup? Also maybe consider a datatable or a Watchlist if there are just a few to lookup?

// this has both GUIDs but no name either
UserPeerAnalytics
| project AADTenantId, TenantId