Get Username by IP Address

Question

Hello,

Can we get Microsoft Entra ID by providing the ip address using powershell? I have Network Monitoring System to see the conversation traffic, but unfortunately the NMS only showing the ip address as the source and i want to know this ip is belong to which Entra ID.

Answer 1

Hello @Handian Sudianto,

Thank you for posting your query on Microsoft Q&A.

To identify which Microsoft Entra ID user is associated with a specific IP address within your tenant, you can query the Microsoft Entra sign-in logs using PowerShell. These logs contain information about user sign-ins, including the IP address from which the sign-in originated.

Here is a step-by-step guide to achieve this:

1. Install the Microsoft Graph PowerShell SDK Module: If you haven't already installed the Microsoft Graph PowerShell SDK module, you can do so using the following command: Install-Module Microsoft.Graph.Beta
2. Connect to Microsoft Graph: You need to authenticate and connect to your Microsoft Entra tenant. Connect-MgGraph -scopes AuditLog.Read.All
3. Query the Sign-In Logs: Use the Get-MgBetaAuditLogSignIn cmdlet to query the sign-in logs for the specific IP address.

Here is an example PowerShell script to get the sign-in logs for a specific IP address:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Install the Microsoft Graph module if not already installed
Install-Module Microsoft.Graph.Beta

Import-Module Microsoft.Graph.Beta.Reports

# Connect to Microsoft Graph
Connect-MgGraph -scopes AuditLog.Read.All

# Define the IP address you are looking for
Get-MgBetaAuditLogSignIn -Filter "(createdDateTime ge 2024-07-25T04:33:42.604Z and createdDateTime lt 2024-08-01T04:33:42.604Z and contains(tolower(ipAddress), '20.81.101.134'))" -Top 50 -Sort "createdDateTime desc" | Where-Object {$_.IpAddress -eq "192.168.1.100"} | Select-Object UserId, UserDisplayName, IpAddress

This script will output the UserId, UserDisplayName, IpAddress for each sign-in event from the specified IP address.

Additional Steps

If you need more detailed information or need to filter the results further, you can adjust the Select-Object cmdlet to include additional properties from the sign-in logs. Here are some additional properties you might find useful:

userPrincipalName

ipAddress

createdDateTime

appDisplayName

status

location

clientAppUsed

For example, to include the status and location of the sign-in, you can modify the Select-Object line as follows:

Select-Object userPrincipalName, ipAddress, createdDateTime, appDisplayName, status, location

Note

• Ensure you have the necessary permissions to access Azure AD sign-in logs.
• The Get-MgBetaAuditLogSignIn cmdlet may return a large number of results if the IP address is used frequently. You can use additional filters to narrow down the results if needed.

By following these steps, you should be able to identify which Microsoft Entra ID user is associated with the specified IP address.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thanks,
Raja Pothuraju.