Find Azure Permissions changes on the platform
Make sure Diagnostic Settings
are enabled on the subscription and you are exporting the Security
category. Run the query below on the Log Analytics workspace to find recently changed permissions.
Run the below query.
let JoinedLogs = AzureActivity
| where OperationNameValue has "Microsoft.Authorization/roleAssignments"
| join kind=inner (
AzureActivity
)
on CorrelationId, TimeGenerated;
JoinedLogs
| extend AssignmentPropertiesRaw = iif(ActivityStatusValue startswith 'Start', parse_json(tostring(parse_json(Properties1).requestbody)).Properties, parse_json(tostring(parse_json(Properties).responseBody)).properties)
| extend AssignmentProperties = parse_json(tolower(AssignmentPropertiesRaw))
| extend ScopeSegments = split(iif(strlen(ResourceId) == 0, _ResourceId, ResourceId), '/')
| extend ScopeLevel = case(array_length(ScopeSegments) == 5, "Managementgroup", array_length(ScopeSegments) == 7, "Subscription", array_length(ScopeSegments) == 9, "Resourcegroup", array_length(ScopeSegments) >= 11, "Resource", "Unknown")
| extend ResourceType = iif(ScopeLevel =~ 'Resource', strcat(ScopeSegments[6], '/', ScopeSegments[7]), '')
| extend ResourceName = iif(ScopeLevel =~ 'Resource', tostring(ScopeSegments[8]), '')
| project
TimeGenerated,
ScopeLevel,
ResourceType,
ResourceName,
ResourceId = iif(strlen(ResourceId) == 0, _ResourceId, ResourceId),
ResourceGroup,
SubscriptionId,
Caller,
OperationName = iff( OperationNameValue endswith 'WRITE', tostring('Create role assignment'), tostring('Delete role assignment')),
AssignmentId = iif(strlen(Resource) == 0, parse_json(Properties).resource, Resource),
AssignmentPrincipalType = iff(isnotempty(AssignmentProperties.principaltype), AssignmentProperties.principaltype, AssignmentProperties.assignmenttype),
AssignmentPrincipalId = iff(isnotempty(AssignmentProperties.principalid), AssignmentProperties.principalid, AssignmentProperties.AssignmentPrincipalId),
AssignmentDescription = AssignmentProperties.description,
AssignmentCreatedBy = AssignmentProperties.createdby,
AssignmentCreatedOn = AssignmentProperties.createdon,
AssignmentRoleDefinition = split(AssignmentProperties.roledefinitionid, '/')[-1],
CorrelationId
| where AssignmentPrincipalType != ''
which results in a similar reply.