Azure KQL Query on Dashboard

Question

KQL query to reveal Azure Activity actions which should include users management activities based on any change performed by a users (create, update &delete) &identify the user by email/profile, tenant ID, subscription, activity logs under a tenant subscription

i got a query but could not identify user which perform a task.

Answer 1

Use below KQL query to meet your requirements.

AzureActivity
| where ActivityStatus == "Succeeded"
| where ResourceProvider == "Microsoft.Authorization" and TenantId == "xxxx"
| extend properties = todynamic(tostring(Properties))
| extend tenantID = properties["tenantId"]
| extend subscriptionID = properties["subscriptionId"]
| extend activity = parse_json(properties["activityLogs"])
| project Caller, TenantId

Output: