Azure: How do you set a Custom log search to view the results and also be used when creating an alert to notify when a PIM role or Azure Resource Role is about to expire?

Manuel 21 Reputation points
2022-03-24T05:38:13.007+00:00

Hi,

Can someone help me with a custom search log for an azure alert so that when a PIM role or an Azure Resource Assignment is about to expire it triggers an alert/notification?

As an example: this will generate an alert when an additional person is added to global admin role.

AuditLogs
| where OperationName contains "Add member to role" and TargetResources contains "Company Administrator"

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,868 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,866 questions
0 comments No comments
{count} votes

Accepted answer
  1. AmanpreetSingh-MSFT 56,336 Reputation points
    2022-03-29T19:10:12.567+00:00

    Hi @Manuel • You can use below query for this purpose.

    AuditLogs  
    | where LoggedByService == "PIM" and OperationName == "Add eligible member to role in PIM completed (timebound)" or OperationName == "Add member to role completed (PIM activation)"  
    | project User=TargetResources[2].userPrincipalName, ExpriationTime=AdditionalDetails[3].value  
    

    188028-image.png


0 additional answers

Sort by: Most helpful