De-provisioned users data

asked 2022-12-26T08:41:04.097+00:00

From where we can get the de-provisioned users data in azure log analytics?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
1,804 questions
{count} votes

1 answer

Sort by: Most helpful
  1. answered 2023-01-12T05:31:33.4266667+00:00
    AnuragSingh-MSFT 9,976 Reputation points Microsoft Employee

    @Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , I am sorry I am unsure if I understand the ask clearly. Log Analytics Workspace is used to store monitoring and diagnostic data (metrics and logs related to a service).

    Since you are looking for data related to de-provisioned user, I assume that you are looking for audit/sign-in related logs as generated from Azure AD. If diagnostic settings were enabled in Azure Active directory to forward these logs to Log Analytics Workspace, you would be able to see them in "AuditLogs" and "SigninLogs" tables. For more details, please see the links below

    You can view these logs in Log Analytics workspace in AzureActivity tables. Some of the sample queries are available in the link below: View activity logs for Azure RBAC changes

    Please see "Azure Monitor Logs" section in this link for details on configuring the activity log forwarding to LA workspace and querying it.

    In case the details and links above do not answer your question, please provide some examples of "Data or logs" that you are looking for with some example scenario. This should help us understand the question better.

    Please let us know if you have any questions.

    No comments