Create alert if somebody creates application registration with not single tenant

@SadiqhAhmed-MSFT Hi,

Many thanks for your answer. You understood me me a little bit incorrect. I would like to get alert notifications for cases when new App Registrations is NOT of "Single Tenant". That's why I set in KQL line "| where signInAudience != "AzureADMyOrg""
I have tried query:
AuditLogs

| where Category == "ApplicationManagement"

| where OperationName == "Add application" or OperationName == "Update application"

| limit 10

but it shows me some outputs but there is nothing about signInAudience :(

Any ideas?

P.S. creating an alert is not problem. The major moment is getting correct query.

Best regards,

Viktor

@Viktor Korokhov Sorry for the delayed response!

The issue you're facing is that the signInAudience information is not directly available in the AuditLogs in the form you're expecting. This might be because the signInAudience field may not be included in the default AuditLogs schema for Add application or Update application operations.

You can try to adjust the query:

To ensure you're getting the correct fields from your logs, first check the structure of the data and confirm that signInAudience is part of the audit log for app registrations. You can do this by querying for some initial data and then expanding the result to inspect the available fields.

AuditLogs
| where Category == "ApplicationManagement"
| where OperationName == "Add application" or OperationName == "Update application"
| limit 50

This will allow you to see the fields associated with Add application and Update application. If signInAudience is available, it should show up in the result. If not, it may be stored elsewhere.

In some cases, information about the sign-in audience might not directly appear in the AuditLogs for Add application or Update application. Instead, it may be found in the Azure AD Application logs (specifically in a different dataset, like SignInLogs, or a custom field associated with the Application registration process).

The correct field might be available in the AppRegistrations data table or other logs related to applications. You can query for App registrations in a more specific way:

AppRegistrations
| where signInAudience != "AzureADMyOrg"
| limit 50

This query will return all App Registrations where the signInAudience is not AzureADMyOrg, which corresponds to a multi-tenant app registration.

Once you confirm that the data is available (either from AuditLogs or AppRegistrations), you can refine your query to create an alert. For instance:

AuditLogs
| where Category == "ApplicationManagement"
| where OperationName == "Add application" or OperationName == "Update application"
| extend signInAudience = tostring(parse_json(Properties).signInAudience)
| where signInAudience != "AzureADMyOrg"
| project TimeGenerated, OperationName, TargetResources, signInAudience
| limit 50

In the above query:

• We are using extend and parse_json to extract the signInAudience from the Properties field (if it’s available).
• The query checks if the signInAudience is not equal to AzureADMyOrg (Single Tenant).
• This query can then be used to configure an alert.

Let us know how it goes!

I have checked lots of results for query:

AuditLogs 
| where Category == "ApplicationManagement" 
| where OperationName == "Add application" or OperationName == "Update application" | limit 50

But I don't see signInAudience at all. It is confused me.

We don't have AppRegistrations data table in any Log Analytics workspace.

So, starnge situation.

Could it be that I have missed somethings to get this option in logs?

Best regards,

Viktor

@Viktor Korokhov It's not easy to troubleshoot your issue without deeper analysis of logs. Can you contact Azure technical support team by raising a support ticket?

ok, I will do it