Skip to content

Instantly share code, notes, and snippets.

@f-bader

f-bader/FindMissingFirstPartyAppIds.kql

Created January 7, 2025 08:43
Show Gist options
  • Save f-bader/644e1c097a17d6adea3af7b78303852d to your computer and use it in GitHub Desktop.
Save f-bader/644e1c097a17d6adea3af7b78303852d to your computer and use it in GitHub Desktop.
Download ZIP
Find missing first party Microsoft based on WorkloadIdentityInfo - Create a pull request to help https://github.com/merill/microsoft-info/blob/main/customdata/OtherMicrosoftApps.csv
Raw
FindMissingFirstPartyAppIds.kql
let 1stPartyMicrosoftAppIds = externaldata (AppId: string, AppDisplayName: string, AppOwnerOrganizationId: string, Source: string)[
"https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.csv"
] with(format="csv", ignoreFirstRecord=true);
_GetWatchlist('WorkloadIdentityInfo')
| where AppOwnerTenantId in ("f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47")
| summarize by tostring(AppId), tostring(AppDisplayName), tostring(AppOwnerTenantId)
| join kind=leftanti (1stPartyMicrosoftAppIds) on AppId
| extend Source ="GitHub"
| project AppId, AppDisplayName, AppOwnerOrganizationId=AppOwnerTenantId, Source
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment