Kusto Query searching for when an Entra ID user account has been enabled and after that, the password has been reset on that account

Question

I am trying to write a Kusto query to search for when a user account has been enabled and after that, the password has been reset on that account. I have got this far, but still not sure if this is right, I would love someone to help me please!

let EnableEvents = AuditLogs
    | where OperationName == "Enable account"
    | extend Initiatedby = InitiatedBy.user.userPrincipalName  
    | project TimeGenerated, InitiatedBy = InitiatedBy.user.userPrincipalName;
let ResetEvents = AuditLogs
    | where OperationName in ("Change user password", "Change password (self-service)")
    | extend Initiatedby = InitiatedBy.user.userPrincipalName  
    | project TimeGenerated, InitiatedBy = InitiatedBy.user.userPrincipalName;
EnableEvents
| join kind=inner ResetEvents on $left.Initiatedby == $right.Initiatedby
| where TimeGenerated > TimeGenerated
| project
    EnableTime = TimeGenerated,
    ResetTime = TimeGenerated,
    InitiatedBy = EnableEvents.InitiatedBy

Answer 1

@Mark Summers Thank you for reaching out to us, As I understand you are looking for KQL to achieve this - when an Entra ID user account has been enabled and after that, the password has been reset on that account Worked with my colleague, here is the KQL query which can help you to achieve your ask

let EnableEvents = AuditLogs
    | where OperationName == "Enable account"
    | mv-expand TargetResources
    | extend  a = tostring(TargetResources.userPrincipalName) 
    | project TimeGenerated, a;
let ResetEvents = AuditLogs
    | where OperationName in ("Change user password", "Change password (self-service)")
    | extend b = tostring(InitiatedBy.user.userPrincipalName  )
    | project TimeGenerated, b;
EnableEvents
| where TimeGenerated > ago(7d)
| join kind=inner ResetEvents on $left.a == $right.b
| extend EnableTime = todatetime(TimeGenerated) , ResetTime = todatetime(TimeGenerated1)
| where TimeGenerated < TimeGenerated1
| project  EnableTime, ResetTime,a

I have tested the same in my tenant and is working as expected. Let me know if you have any further questions feel free to post back. Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.