De-provisioned users data

Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41

From where we can get the de-provisioned users data in azure log analytics?

AnuragSingh-MSFT 19,856 Reputation points

2022-12-30T05:24:16.137+00:00
@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , Please answer the queries below to help us understand the question.

Can you please elaborate the question with some additional context?

By "de-provisioned users data", do you mean the user who has been deleted from Azure AD? You could also review the information available here - Restore a deleted user.

Log Analytics is an environment for storing log data from Azure Monitor and other Azure services. Depending on where the data comes from, it might be available in anyone of the tables in the LogAnalytics workspace.

Please let me know if you have any questions.
Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41 Reputation points

2022-12-30T09:42:38.923+00:00

Deprovisioning is the act of removing user access to applications, systems and data within a network, So this kind of users data where it will be available and how to get it from log analytics?
Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41 Reputation points

2023-01-02T06:50:50.007+00:00

How to identify how many users onboarded(provision) & Offboarded ?
AnuragSingh-MSFT 19,856 Reputation points

2023-01-03T14:30:05.43+00:00

@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , thank you for the reply. You can view these logs in Log Analytics workspace in AzureActivity tables. Some of the sample queries are available in the link below: View activity logs for Azure RBAC changes

Please see "Azure Monitor Logs" section in this link for details on configuring the activity log forwarding to LA workspace and querying it.

Hope it helps. Please let me know if you have any questions.
AnuragSingh-MSFT 19,856 Reputation points

2023-01-10T05:23:10.037+00:00

@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , I wanted to check if you had a chance to review my reply above. Please let me know if you have any questions

1 answer

AnuragSingh-MSFT 19,856 Reputation points

2023-01-12T05:31:33.4266667+00:00
@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , I am sorry I am unsure if I understand the ask clearly. Log Analytics Workspace is used to store monitoring and diagnostic data (metrics and logs related to a service).

Since you are looking for data related to de-provisioned user, I assume that you are looking for audit/sign-in related logs as generated from Azure AD. If diagnostic settings were enabled in Azure Active directory to forward these logs to Log Analytics Workspace, you would be able to see them in "AuditLogs" and "SigninLogs" tables. For more details, please see the links below

Integrate Azure AD logs with Azure Monitor logs

Analyze Azure AD activity logs with Azure Monitor logs

You can view these logs in Log Analytics workspace in AzureActivity tables. Some of the sample queries are available in the link below: View activity logs for Azure RBAC changes

Please see "Azure Monitor Logs" section in this link for details on configuring the activity log forwarding to LA workspace and querying it.

In case the details and links above do not answer your question, please provide some examples of "Data or logs" that you are looking for with some example scenario. This should help us understand the question better.

Please let us know if you have any questions.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment