Queries for the AADCustomSecurityAttributeAuditLogs table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

User's custom security attribute audits

Returns custom security attribute audit logs for a specific user.

AADCustomSecurityAttributeAuditLogs
| extend targetUPN = parse_json(TargetResources)[0].userPrincipalName
| where targetUPN == 'CSALogTester@tenant.com'
| limit 100