Link Audit logs to Groups or Role or Privilege

Swapnil Khamkar 0

I am wondering how can I link the audit logs from Azure AD to Role, Group or Privilege?

The logs just have the action and the category. Is there a way by which I can understand using what Role or Group privilege this action was taken?

Shweta Mathur 30,101 Reputation points Microsoft Employee

2024-05-07T03:44:47.1333333+00:00

@Swapnil Khamkar Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Shweta Mathur 30,101 Reputation points Microsoft Employee

2024-05-16T11:24:35.0866667+00:00

@Swapnil Khamkar Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

2 answers

Crystal-MSFT 50,591 Reputation points Microsoft Vendor

2024-05-01T05:44:39.0833333+00:00

@Swapnil Khamkar, Thanks for posting in Q&A. Based on my researching, there is no direct way to link audit logs to a specific role, group, or privilege, you can use the information provided in the logs to determine who initiated the action ("Initiated by" field) and "Target(s)" field which targets were affected.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/monitor-audit-logs#use-audit-logs-to-track-and-monitor-events-in-microsoft-intune

Meanwhile, you can feedback in the following link to request the feature and see if we can get this in the future:

https://feedbackportal.microsoft.com/feedback/forum/ef1d6d38-fd1b-ec11-b6e7-0022481f8472

Best regards.

Crystal

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Swapnil Khamkar 0 Reputation points

2024-05-09T15:32:58.1666667+00:00

Thanks for the reply. If not direct, is there an alternative way to do it for now? Like take the category and activityDisplayName or operationType and figure out the roles or privileges from it?

Crystal-MSFT 50,591 Reputation points Microsoft Vendor

2024-05-10T05:15:38.5133333+00:00

@Swapnil Khamkar, Thanks for the reply. For the Role create, edit, assign, I find the Category is Role. You can use Category to filter out. But for group, this is not recorded in Intune. For privilege, you can check in audit log to see if it has a specific category to filter.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Swapnil Khamkar 0 Reputation points

2024-05-09T22:45:58.3+00:00

Is there a way in which I can map the category or its description with the privilege or its description
Please sign in to rate this answer.
Shweta Mathur 30,101 Reputation points Microsoft Employee

2024-05-13T06:47:28.8133333+00:00

@Swapnil Khamkar PIM audit history allows you to see all role assignments and activations for all privileged roles.

Reference - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/azure-pim-resource-rbac
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Link Audit logs to Groups or Role or Privilege

2 answers

Your answer