In an earlier blog here, we looked at steps to retrieve Office 365 Audit log data using PowerShell. Searching for a deleted user in Log Analytics with KQL (Kusto Query Language) is definitely more feasible and allows us to search for the userPrincipalName with the “contains” operator.For creating custom reports on Office 365 content, the best approach is to fetch the Audit data from Office 365 Management Audit log, store it in a custom database and then create reports through it. I wrote a blog post a few months ago where I described how to forward your Azure AD & Intune logs to Log Analytics.

If you are not forwarding your Azure AD audit logs and you do not have an SIEM or monitoring solution in place it is the call to action to deploy an Azure Log Analytics Workspace! Note: Azure AD Premium (P1 / P2 plans) retains audit and sign-in logs only 30 days! Source. The only option in the Azure AD Audit Logs would be to download the logs and perform a search within a text editor which is not really feasible nor efficient. Which means we cannot search for the userPrincipalName. Search is case-sensitive and only supports ‘starts with’ operator userPrincipalName after deletion: īy having a closer look to the Azure Active Directory Audit logs you will notice that the filtering or search capabilities are limited in terms of searching for a specific target:.The userPrincipalName attribute will get the Azure AD object ID as prefix: Here’s what the Azure AD Audit log shows us: And I doubt that you memorized the Azure AD object id of that user.

When a user gets deleted and you only remember it’s userPrincipalName you wont be able to to search for a match. An account in your Azure Active Directory got deleted and you want to examine who initiated the delete action? Sounds very simple but if you do not want to search your logs manually things become a little bit trickier.

Azure ad audit logs