Queries for the AADProvisioningLogs table
Provisioning actions for the last week
Shows the number of users and groups created, updated, disabled, and deleted in the past 7 days.
AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, Action
| order by Type, Action
Provisioning errors
Shows the count per error code and when were they last seen.
AADProvisioningLogs
| where ResultType == "Failure"
| summarize Occurrences=count(), LastSeen=max(TimeGenerated) by ResultSignature
| order by LastSeen
Provisioned objects by day
Summarizes for each day the number of created objects per day.
AADProvisioningLogs
| where TimeGenerated > ago(7d)
| where ResultType == "Success"
| where Action == "Create"
| parse SourceIdentity with * "\"identityType\":\"" Type "\"" *
| extend Type = tolower(Type)
| summarize count() by Type, bin(TimeGenerated, 1d)
| render columnchart
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for