kqlHunting

Removal of Roles Post GDAP relationship ending

Removal of roles after Granular admin relationship has ended

Detection Query

AuditLogs //Removal of roles after Granular admin relationship has ended 
| where OperationName == @"Remove member from role"
| extend App = InitiatedBy.app.displayName
| where App == 'Partner Customer Delegated Admin Offline Processor'
| extend PartnerID = AdditionalDetails[0].value

Data Sources

AuditLogs

Platforms

azure-ad

Tags

entra

Raw Content

AuditLogs //Removal of roles after Granular admin relationship has ended 
| where OperationName == @"Remove member from role"
| extend App = InitiatedBy.app.displayName
| where App == 'Partner Customer Delegated Admin Offline Processor'
| extend PartnerID = AdditionalDetails[0].value