Skip to content

Instantly share code, notes, and snippets.

@alexmags

alexmags/SharePointAdminCentreMakesCAPolicies.kql

Last active February 26, 2022 08:09
Show Gist options
  • Save alexmags/5e8dd588c51df4f6f5ed17732d317d2e to your computer and use it in GitHub Desktop.
Save alexmags/5e8dd588c51df4f6f5ed17732d317d2e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SharePointAdminCentreMakesCAPolicies.kql
// KQL because SharePoint Admin centre can make surprise new Conditional Access policies when you configure tenant level settings.
// Look for SharePoint ID and brackets in display name
// Create a notification action on AAD audit logs when this happens. https://blog.alexmags.com/tags/kql/
AuditLogs
| where Category == "Policy" and (Identity == 'Office 365 SharePoint Online' or TargetResources[0].displayName contains '[')
| project TimeGenerated, OperationName, TargetResources[0].displayName,Identity,InitiatedBy.user.userPrincipalName
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment