i am need help creating a KQL query to find out when and who created a new user

Question

i am need help creating a KQL query to find out when and who created a new user

Peter Snydert 0

1 answer

Your answer

Answer 1

Goutam Pratti 4,325 Microsoft External Staff

Hello @Peter Snydert ,

I Understand you need help to create KQL query to find out when and who created a new user.

Here is the KQL query which can help you to achieve your ask.

AuditLogs
| where OperationName == "Add user"
| project TimeGenerated, InitiatedBy = tostring(InitiatedBy.user.userPrincipalName),
CreatedUser = tostring(TargetResources[0].userPrincipalName),
CreatedUserDisplayName = tostring(TargetResources[0].displayName),
ActivityDisplayName
| sort by TimeGenerated desc

User's image I have tested the same in my tenant and is working as expected. Let me know if you have any further questions feel free to post back. Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Goutam Pratti 4,325 Reputation points Microsoft External Staff

2025-04-10T10:23:28.75+00:00

Hello @Peter Snydert ,

following up to see if the above suggestion is helpful. Let us know if you have any additional queries. Happy to assist you further.
Goutam Pratti 4,325 Reputation points Microsoft External Staff

2025-04-11T20:07:01.87+00:00

Hello @Peter Snydert ,

following up to see if the above suggestion is helpful. Let us know if you have any additional queries. Happy to assist you further.

Clive Watson 7,636 MVP

as a small tweak you can (as I prefer) use this alternative syntax

AuditLogs
| where OperationName == "Add user"
| mv-expand TargetResources 
| project
    TimeGenerated,
    InitiatedBy = InitiatedBy.user.userPrincipalName,
    CreatedUser = TargetResources.userPrincipalName,
    CreatedUserDisplayName = TargetResources.displayName,
    ActivityDisplayName
| sort by TimeGenerated desc

Share via

i am need help creating a KQL query to find out when and who created a new user

1 answer

Your answer