Dataverse - Identity management activity outside of privileged directory role membership

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query detects identity administration events in Dataverse/Dynamics 365 made by accounts which are not members of privileged directory roles 'Dynamics 365 Admins', 'Power Platform Admins' or 'Global Admins

Attribute	Value
Type	Hunting Query
Solution	Microsoft Business Applications
ID	c7e6e48a-0514-4989-bc90-4a3c9207ede1
Tactics	PrivilegeEscalation
Techniques	T1078, T1078.004
Required Connectors	Dataverse, IdentityInfo
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
DataverseActivity	✓	✗	?
IdentityInfo	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Microsoft Business Applications