Here is the first of several articles with tips on how you can leverage Azure Kusto Query Language (KQL) for various tasks in your Microsoft Azure environment. (Microsoft has an overview of KQL here.) Sometimes you want to keep track of the RBAC changes on your resources. This Kusto Query Language will provide a summarized view of all successful attempts to add or remove entries in the Azure resources. The same query can be customized to narrow down the results by resource type, in case you are targeting a specific resource or even a name (perhaps too specific in a corporate environment).
The results of the query are depicted in the image below.
The query required to provide that output is listed below.
AzureActivity | where TimeGenerated > ago(24h) | where (OperationNameValue == 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' or OperationNameValue == 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/DELETE') | where ActivityStatusValue == 'Success' | order by TimeGenerated desc
