Azure AD Identity Protection alerts missing 'accountName' information

Joseph Redfern 11

Hi,

Alerts retrieved from the Graph API which originated from Azure AD Identity Protection no longer seem to populate the accountName, userPrincipalName or domainName fields for entries in the userStates array.

This seems to have started around the end of September, and is impacting multiple tenants.

Is this expected behaviour, or a bug? I examined the Graph API changelog but couldn't find any reference to this change.

Thanks,
Joe

Mehtab Siddique (MINDTREE LIMITED) 966 Reputation points

2022-10-24T12:09:03.723+00:00

Hi @Joseph Redfern , Can you please API Query details along with the response along with client request id and timestamp, Thanks.
Joseph Redfern 11 Reputation points

2022-11-15T19:16:48.1+00:00

Hi @ Mehtab Siddique (MINDTREE LIMITED) , apologies for the delay.

Is there a way I could send this information to you privately?
Joseph Redfern 11 Reputation points

2022-12-13T16:16:34.517+00:00

Hi @ Mehtab Siddique (MINDTREE LIMITED)

I've re-created this in a sandbox environment and so can share the information you requested publically.

Query URL: https://graph.microsoft.com/v1.0/security/alerts?$filter=id eq '47b8f38f05eb751b40ed3c1400d3013657a62fbf432af6de1a7961106abc5d60'&$top=1000
Client Request ID: 78c99f6a-ac11-4795-af9a-b81e1b589b96

As described -- the entries in the userStates array for this alert include a populated aadUserId field, but no values for accountName, userPrincipalName, or domainName.

Share via

Azure AD Identity Protection alerts missing 'accountName' information

Your answer