Queries for the AVNMRuleCollectionChange table

Get recent security admin rule collection changes

List 10 most recent security admin rule collection changes.

AVNMRuleCollectionChange
|where OperationName has("securityAdminRuleCollections")
|top 10 by TimeGenerated desc
|project TimeGenerated, NetworkResourceIds, AppliedRuleCollectionIds, ResultType

Get recent failed security admin rule collection changes

List 100 most recent failed security admin rule collection changes.

AVNMRuleCollectionChange
|where OperationName has("securityAdminRuleCollections")
|where ResultType != "Success"
|sort by TimeGenerated desc
|take 100