Azure log analytics - get logs for all users in global administrator role

user_18532782 0
Viewed 180

I'm sorry for not having much to go on with this. My boss has asked for logs of all administrative actions performed in Azure. I did some research and was able to set up Log Analytic to get all administrative logs from Azure Activity. I also sent all of the AAD audit logs to Log Analytics. My issue is now filtering through the audit logs with KQL. I have no clue how to pull the logs from only the users in the global admin role. If someone could point me in the right direction it would be greatly appreciated.

azure-log-analytics kql
1 Answers
AzureActivity
| where TimeGenerated > ago(70d)
| where Caller contains "@yourdomain.com"
//| where ResourceProviderValue contains "MICROSOFT.MIGRATE"
//| where ActivityStatusValue contains "Success"
| where ActivityStatusValue !contains "Start"
| extend ResourceName = Properties_d.resource
| project
    TimeGenerated,
    Caller,
    ResourceName,
    ResourceGroup,
    ResourceProviderValue,
    ActivityStatusValue,
    ActivitySubstatusValue,
    CallerIpAddress,
    CategoryValue,
    OperationNameValue
| sort by TimeGenerated desc
user_199486970
Related