User Profile
AndrewX
Iron Contributor
Joined Jul 30, 2016
User Widgets
Recent Discussions
Table relationship not working
I have a simple setup, 1x csv called costs, 1x csv called orders. I added them to the data model, and made a relationship on the product column. I then created a powerpivot table and was hoping to sum the costs by product and/or name, but it wont calculate properly. Any clues? Not calculating properly Even though it is complaining about the relationship, i have already set that up.Doagnostic settings vs Log export feature for archiving
In Azure Active Directory, you can enable Diagnostic Settings, select Logs and configure them for archive in a Storage Account. In Azure Log Analytics, you can select Data Export, select Logs and configure them for archive in a Storage Account. Can someone describe the pros/cons/differences, right/wrong, when to use one over the other, how to decide which one to configure etc?Re: Office365 Unified Audit log bring into an Azure Log Analytics Workspace
grabery this does not answer the question. cryptoSHA has asked for the Unified Audit Log to be streamed into Azure Log Analytics, which historically was achieved by adding the Office 365 Solution, and data was put into the OfficeActivity Table. This is no longer possible and i *think* the only way is to add the solution through Sentinel. What you have provided is how to enable the Azure AD Diagnostic settings and send the Sign In logs only.Re: Is there a way to find out who owns a Form?
Jeffrey Thorpe I use this method. It will search the CASB for events where someone has edited a form. If someone can edit a form, that implies that person is the owner or has co-ownership of the form. CloudAppEvents | where Application == "Office 365" | where TimeGenerated >ago(90d) | project TimeGenerated, ActionType, RawEventData | where ActionType == "EditForm" | evaluate bag_unpack(RawEventData, columnsConflict='replace_source') // | where FormId == "nnn" | where SourceApp == "ms-formweb" | project TimeGenerated, UserId, FormName, FormId This query results in something like this. A list of Forms that have been edited, and i can see who edited them.Re: Start an Automation Runbook with Parameters from a Power App Button
AndrewX Nicol Hanekom BasedRaj115 In the end, calling AZ Automation directly from the AZ Automation Power App Connector did not work, instead you can do the following. 1. Use a flow 2. Create a Custom Connector and use that (Recommended) or option 3. Which is what I have done, I use Azure Functions and a Custom ConnectorSwimming results and cool charts!
Hi Im a proud Dad but not great with Excel. My boy just started swimming, he's 5 and apparently he's a little rocket. I have captured his recent two swimming meets into Excel, but would really love some tips on visuals and modeling so that i can keep adding to it as he progresses. I have attached the source data in XLSX. The [data] column is how i receive it from the competition organisers, and then i have used "Flash Fill" to expand it out to the other columns, as well as added other relevant columns, like the date and swimming style etc. How can i start to make some pretty graphs with this data?Custom Log schema design
I am retrieving sign in and activity audit data from 3 source systems with 3 different scripts, one for each system, and preparing to send them to a custom log in Azure Monitor/Log Analytics/Sentinel. I know that once in Azure Monitor I will be writing queries and having to join or union the 3 datasets, so my questions are; Should I try normalise the fields, and add all three logs into a single Azure Monitor log table? Should I keep them in 3 separate tables and use "join" commands to bring them together? I remember in Filebeat, it would hold many different log sources in the one index (table), and so wondering if i should do the same here in Azure?Custom Log schema design
I am retrieving sign in and activity audit logging from 3 source systems with 3 different scripts, one for each system, and preparing to send them to a custom log in Azure Monitor. I know that once in Azure Monitor I will be writing queries and having to join or union the 3 datasets, so my questions are; Should I try normalise the fields, and add all three logs into a single Azure Monitor log table? Should I keep them in 3 separate tables and use "join" commands to bring them together? I remember in Filebeat, it would hold many different log sources in the one index (table), and so wondering if i should do the same here in Azure?Start an Automation Runbook with Parameters from a Power App Button
I have the following code for a Button OnSelect function. The Azure Automation Runbook has 3 required paramters with matching names to the record below. When i click the button, the automation runbook fails because "Cannot process command because of one or more missing mandatory parameters:" Any idea how to pass parameters to a runbook in a PowerApp. PS. I want to do this directly in a PowerApp button, NOT trigger a Flow AND THEN trigger a Runbook. Set(AZAutomation,AzureAutomation.CreateJob( "nnnn-nnnn-nnnn-nnnn", "nnnn", "nnnn", { runbookName:"MailboxManagement", wait: true, body: JSON( { param1: ComboBox1.Selected.UserPrincipalName, param2: ComboBox2.Selected.UserPrincipalName, param3: DropDown1.SelectedText.Value } ) } ))Re: SecurityAlert doesn't include important alert details
So for now shall we keep using the other portals, where the information is already available? I just wish we could create alerts/notifications using playbooks for these events. Looks like ill have to write a custom Kusto query in LA and create an $1.50 alert based on it for now.SecurityAlert doesn't include important alert details
In the MS 365 Defender, we have an alert generated on "Granted mailbox permission" activity. This event shows up in the SecurityEvent and OfficeActivity $tables, over in Log Analytics. In OfficeActivity, it holds all the information about who did it, and who they did it to. In SecurityAlerts, it only includes the "who did it" information, but not the "who they did it to" information. This means Analysts can't use Sentinel for investigation, and have to go off to other portals to get more info and it means we can't write playbooks using the Sentinel Alerts trigger. Are we missing something?Azure Automation delegated permissions
Hey, we're looking at moving our (some) admins from the Office365 admin portal to a custom powerapp for some administrative tasks. The PowerApp, calls MS Flow, which triggers Azure Automation and everything is working... HOWEVER, in the Azure audit logs, the "actor" is obviously the Azure AD Service Principal, rather than the human administrator. For this particular task, I have to use Application Permissions and cannot use Delegated Permissions. Is there anyway to log the admin rather then the Azure AD App?
