↳ GitHub sourceAnalytics ruleInformational

Dataverse - Organization settings modified

Description

Identifies changes made at organization level in the Dataverse environment.
Rule type
Scheduled
Version
3.2.0
Declared status
Available
Query frequency
1h
Query period
14d
Trigger
gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| extend FieldName = tostring(Fields.Name)
| extend Value = tostring(Fields.Value)
| where FieldName != "organizationid"
| lookup MSBizAppsOrgSettings on FieldName
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    FieldName,
    Value,
    DisplayName,
    Description,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

Declared entities

AccountIPCloudApplication

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
a6f6b734-3db8-4259-a988-69e0b8eac0c2
Additional source files 2Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yamlsource ↗Solutions/Microsoft Business Applications/Data/Solution_PowerPlatform.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.