Skip to content

Instantly share code, notes, and snippets.

@ehrnst

ehrnst/find-resource-writes.kql

Last active August 28, 2020 08:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ehrnst/24491e7480e7572c9da4e7fb7844e9b0 to your computer and use it in GitHub Desktop.
Save ehrnst/24491e7480e7572c9da4e7fb7844e9b0 to your computer and use it in GitHub Desktop.
Download ZIP
Azure Monitor Logs subscription activity
Raw
find-resource-writes.kql
AzureActivity
| where Authorization_d.action has "write"
| where CategoryValue == "Administrative"
| where ActivityStatusValue == "Success"
| where OperationNameValue !in (
"MICROSOFT.AUTHORIZATION/POLICYDEFINITIONS/WRITE",
"MICROSOFT.AUTHORIZATION/POLICYSETDEFINITIONS/WRITE",
"MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/WRITE")
| distinct _ResourceId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment