有没有办法使用 KQL 获取 Azure AD 用户的信息答案

【问题标题】：Is there a way to get Azure AD user's information using KQL有没有办法使用 KQL 获取 Azure AD 用户的信息
【发布时间】：2021-06-17 14:49:47
【问题描述】：

我正在尝试使用 KQL 直接从 Azure AD 获取用户信息，例如 DisplayName 和 UserPrincipalName。有办法吗？

【问题讨论】：

一般用户属性/属性默认不可用。可以查询用户活动/审计日志等。但是，您需要提供更多上下文。您想从不同的 Azure/O365/M365 产品中获取用户属性/属性或其他内容吗？您的问题有点含糊，如果可能的话，您能否描述您的问题，您想要实现什么？届时将更容易理解和评估解决方案。
感谢您的回复。我正在尝试将 OfficeActivity 日志与任何可以提供用户的 DisplayName 而不是 OfficeObjectID（全名）的日志一起加入。 OfficeObjectID 可能包含不同的值，例如对于具有相同显示名称的两个用户，它看起来像这样：Doe, John - 1 Doe, John - 2 而他们的显示名称是 Doe, John。

标签： azure-active-directory kql

【解决方案1】：

最终使用 PowerShell 导出所需用户的属性并将输出复制到 Blob 容器中，然后运行以下 KQL 查询以将文件内容与查询连接：

let UserAtt = externaldata (UserPrincipalName:string, DisplayName:string) [
@"URL to the file location in the blob storage"
h@"?sp="Secret token"
] with (format="csv", ignoreFirstRecord=true);
UserAtt
| join kind=inner (
OfficeActivity
  | where TimeGenerated > ago(1h)
  | where (Operation =~ "Set-Mailbox" and Parameters contains 'ForwardingSmtpAddress') 
  or (Operation =~ 'New-InboxRule' and Parameters contains 'ForwardTo')
  | extend parsed=parse_json(Parameters)
  | extend fwdingDestination_initial = (iif(Operation=~"Set-Mailbox", tostring(parsed[1].Value), tostring(parsed[2].Value)))
  | where isnotempty(fwdingDestination_initial)
  | extend fwdingDestination = iff(fwdingDestination_initial has "smtp", (split(fwdingDestination_initial,":")[1]), fwdingDestination_initial )
  | parse fwdingDestination with * '@' ForwardedtoDomain 
  | parse UserId with *'@' UserDomain
  | extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]),'.',tostring(split(UserDomain, '.')[-1])), '.') [0]))
  | where ForwardedtoDomain !contains subDomain
  | extend Result = iff( ForwardedtoDomain != UserDomain ,"Mailbox rule created to forward to External Domain", "Forward rule for Internal domain")
  | extend ClientIPAddress = case( ClientIP has ".", tostring(split(ClientIP,":")[0]), ClientIP has "[", tostring(trim_start(@'[[]',tostring(split(ClientIP,"]")[0]))), ClientIP )
  | extend Port = case(
  ClientIP has ".", (split(ClientIP,":")[1]),
  ClientIP has "[", tostring(split(ClientIP,"]:")[1]),
  ClientIP
  )
  | project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, OriginatingServer, OfficeObjectId, fwdingDestination
  | extend timestamp = TimeGenerated, AccountCustomEntity = UserId, IPCustomEntity = ClientIPAddress, HostCustomEntity = OriginatingServer)
 on $left.UserPrincipalName == $right.AccountCustomEntity

【讨论】：