{"id":318,"date":"2025-09-16T14:16:13","date_gmt":"2025-09-16T13:16:13","guid":{"rendered":"https:\/\/cyber-resilience.mobi\/?p=318"},"modified":"2025-09-16T14:16:13","modified_gmt":"2025-09-16T13:16:13","slug":"configuration-multi-tenant-et-cross-tenant-dans-entra-id","status":"publish","type":"post","link":"https:\/\/cyber-resilience.mobi\/?p=318","title":{"rendered":"Configuration multi-tenant et cross-tenant dans Entra ID"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Cette requ\u00eate permet de :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Auditer les changements li\u00e9s aux configurations multi-tenant et cross-tenant dans Entra ID<\/strong>.<\/li>\n\n\n\n<li><strong>Identifier les initiateurs (utilisateurs ou apps)<\/strong>\u00a0et leur IP.<\/li>\n\n\n\n<li><strong>Extraire les d\u00e9tails des politiques modifi\u00e9es<\/strong>, y compris les identifiants de partenaires et les tenants impliqu\u00e9s.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>AuditLogs\n| where Category in (\"CrossTenantAccessSettings\", \"CrossTenantIdentitySyncSettings\", \"MultiTenantOrgTenant\", \"MultiTenantOrgIdentitySyncPolicyTemplate\", \"MultiTenantOrgPartnerConfigurationTemplate\")\n    or OperationName has_any (\"cross-tenant\", \"MultiTenantOrg\", \"multi tenant org\")\n| extend\n    Initiator = iif(isnotempty(InitiatedBy&#91;\"app\"]), tostring(InitiatedBy&#91;\"app\"]&#91;\"displayName\"]), tostring(InitiatedBy&#91;\"user\"]&#91;\"userPrincipalName\"])),\n    InitiatorId = iif(isnotempty(InitiatedBy&#91;\"app\"]), tostring(InitiatedBy&#91;\"app\"]&#91;\"servicePrincipalId\"]), tostring(InitiatedBy&#91;\"user\"]&#91;\"id\"])),\n    IPAddress = tostring(InitiatedBy&#91;tostring(bag_keys(InitiatedBy)&#91;0])]&#91;\"ipAddress\"])\n| mv-expand TargetResource = iff(array_length(TargetResources) == 0, dynamic(&#91;\"\"]), TargetResources)\n| mv-apply modifiedProperty = TargetResource&#91;\"modifiedProperties\"] on (\n    summarize NewValues = make_bag(\n        bag_pack(tostring(modifiedProperty&#91;\"displayName\"]), trim(@'&#91;\\\"\\s]+', tostring(modifiedProperty&#91;\"newValue\"]))))\n    )\n| extend\n    PartnerIdentifier = tostring(NewValues&#91;\"PartnerIdentifier\"]),\n    PartnerPolicyType = tostring(NewValues&#91;\"PartnerPolicyType\"]),\n    PartnerPolicyDetail = tostring(NewValues&#91;\"PartnerPolicyDetail\"]),\n    PartnerPolicyDetailVersion = tostring(NewValues&#91;\"PartnerPolicyDetailVersion\"]),\n    MultiTenantOrgAddedByTenantId = tostring(NewValues&#91;\"MultiTenantOrgAddedByTenantId\"])\n| project\n    TimeGenerated,\n    LoggedByService,\n    Category,\n    AADOperationType,\n    Initiator,\n    IPAddress,\n    OperationName,\n    Result,\n    ResultDescription,\n    PartnerIdentifier,\n    PartnerPolicyType,\n    PartnerPolicyDetail,\n    PartnerPolicyDetailVersion,\n    MultiTenantOrgAddedByTenantId,\n    NewValues,\n    AdditionalDetails,\n    Identity,\n    InitiatorId,\n    InitiatedBy,\n    TargetResources,\n    CorrelationId<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Cette requ\u00eate permet de :<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[18],"class_list":["post-318","post","type-post","status-publish","format-standard","hentry","category-kql","tag-kql"],"_links":{"self":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=318"}],"version-history":[{"count":1,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/318\/revisions"}],"predecessor-version":[{"id":319,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/318\/revisions\/319"}],"wp:attachment":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}