Queries for the AADCustomSecurityAttributeAuditLogs table

  • Article

User's custom security attribute audits

Returns custom security attribute audit logs for a specific user.

AADCustomSecurityAttributeAuditLogs
| extend targetUPN = parse_json(TargetResources)[0].userPrincipalName
| where targetUPN == 'CSALogTester@tenant.com'
| limit 100