↳ GitHub sourceAnalytics ruleHigh

Power Automate - Departing employee flow activity

Description

Identifies instances where an employee who has been notified or is already terminated, on the TerminatedEmployees watchlist, creates or modifies a Power Automate flow.
Rule type
Scheduled
Version
3.2.0
Declared status
Available
Query frequency
1h
Query period
7d
Trigger
gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

let query_frequency = 1h;
PowerAutomateActivity
| where TimeGenerated >= ago(query_frequency)
| where EventOriginalType in ("CreateFlow", "EditFlow")
| join kind=inner (MSBizAppsTerminatedEmployees()) on $left.ActorName == $right.UserPrincipalName
| extend path = parse_url(FlowDetailsUrl).Path
| extend EnvironmentId = tostring(split(path, "/")[2])
| extend FlowId = tostring(split(path, "/")[-2])
| extend
    AccountName = tostring(split(ActorName, "@")[0]),
    UPNSuffix = tostring(split(ActorName, "@")[1]),
    PowerAutomateAppId = 27592,
    CloudAppId = 32780
| project
    TimeGenerated,
    EventOriginalType,
    ActorName,
    EnvironmentId,
    AccountName,
    UPNSuffix,
    PowerAutomateAppId,
    CloudAppId,
    FlowId

Declared entities

AccountCloudApplication

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
b1e11b8c-545a-4dea-a912-0008e160d183
Additional source files 2Solutions/Microsoft Business Applications/Analytic Rules/Power Automate - Departing employee flow activity.yamlsource ↗Solutions/Microsoft Business Applications/Data/Solution_PowerPlatform.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.