How to Correlate an Object ID from Activity Log to a User, SPN Claim or UPN Claim

0
votes

Looking through my Azure Audit Logs and see someone deleted a bunch of services. I see under "Initiated by" is a Object ID (GUID). Documentation says this is also refered to in JSON as “caller”.

caller: Email address of the user who has performed the operation, UPN claim, or SPN claim based on availability.

So have now tried these AZ CLI commands with no luck:

Looking for a USER

sdistefa@Azure:~$ az ad user show --upn-or-object-id 5e9a4129-c335-4dcb-84d0-488531e7b026

But get:

Resource '5e9a4129-c335-4dcb-84d0-488531e7b026' does not exist or one of its queried reference-property objects are not present.

Looking for a Service Principal:

sdistefa@Azure:~$ az ad sp list --subscription 9350e6db-d02d-4db7-baee-76f9498dfd13 --spn 5e9a4129-c335-4dcb-84d0-488531e7b026
[]

I need to figure out how to query for a UPN Claim or a Service Principal Claim…… I guess?

I switched to Powershell. I queried myself to see my ObjectId and then tried the command to find myself by a valid ID. PS Azure:> Get-AzureADUser -ObjectId "[email protected]"

ObjectId DisplayName UserPrincipalName UserType -------- ----------- ----------------- -------- f9f1560e-ecba-461d-a811-c0f923a7895a DiStefano, Steve [email protected] Member Azure:/ PS Azure:> Get-AzureADObjectByObjectId -objectid f9f1560e-ecba-461d-a811-c0f923a7895a

ObjectId DisplayName UserPrincipalName UserType -------- ----------- ----------------- -------- f9f1560e-ecba-461d-a811-c0f923a7895a DiStefano, Steve [email protected] Member

Now I try the ObjectId from the activity Log: and it returns a blank: Azure:/ PS Azure:> Get-AzureADObjectByObjectId -objectid 5e9a4129-c335-4dcb-84d0-488531e7b026 Azure:/ PS Azure:>

2
azureazure-active-directory

2 Answers

0
votes

You're passing an ID to the -spn flag with your command az ad sp list however that spn stands for "service principal name" since you're dealing with an id here you'd be better off using az ad sp show and use the -id flag:

az ad sp show --id 00000000-0000-0000-0000-000000000000

0
votes

Using PowerShell, this is what i do:

$valid_email_regex = '^([\w-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([\w-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$'

if ($activityLogs.Caller -match $valid_email_regex) {
  $resourceLogs["event_initiated_by"] = $activityLogs.Caller
}
else {
  $resourceLogs["event_initiated_by"] = "{0} ({1})" -f (Get-AzADServicePrincipal -ObjectId $activityLogs.Caller).DisplayName, $activityLogs.Caller
}

If it's not an e-mail, it's an ObjectId, so I use "Get-AzADServicePrincipal" to retrieve the DisplayName (using the ObjectId indeed). Then I format the result to add the ObjectId in parenthesis after the DisplayName.

So the main command to reply to your question is:

(Get-AzADServicePrincipal -ObjectId ***************).DisplayName