turbot/microsoft365_compliance

Query: azuread_account_provisioning_activity_report_reviewed

Usage

powerpipe query microsoft365_compliance.query.azuread_account_provisioning_activity_report_reviewed

SQL

select
id as resource,
'info' as status,
case
when (initiated_by -> 'user') is not null then initiated_by -> 'user' ->> 'userPrincipalName' || ' was added on ' || date_trunc('day', activity_Date_Time)::date
when (initiated_by -> 'app') is not null then initiated_by -> 'app' ->> 'displayName' || ' was added on ' || date_trunc('day', activity_Date_Time)::date || '.'
end as reason
, tenant_id as tenant_id
from
azuread_directory_audit_report
where
activity_display_name = 'Add user';

Controls

The query is being used by the following controls: