turbot/microsoft365_compliance

Query: azuread_audit_log_search_enabled

Usage

powerpipe query microsoft365_compliance.query.azuread_audit_log_search_enabled

SQL

with audit_count as (
select
tenant_id,
count(id)
from
azuread_directory_audit_report
group by
tenant_id
),
tenant_list as (
select
distinct on (tenant_id) tenant_id,
_ctx
from
azuread_user
)
select
t.tenant_id as resource,
case
when a.count > 0 then 'ok'
else 'alarm'
end as status,
case
when a.count > 0 then t.tenant_id || ' has audit log search enabled.'
else t.tenant_id || ' has audit log search disabled.'
end as reason
, t.tenant_id as tenant_id
from
tenant_list as t
left join audit_count as a on t.tenant_id = a.tenant_id;

Controls

The query is being used by the following controls: