AzureActivity's Caller fields shown as object-id ranther email.

Question

Is it all the Object id caller is related to system action?

For example,
some MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE log show caller is anon@USER , but some of it show as 072c1c95-xxxx-xxxx-xxxx-d2f0bd3cf037.

Answer 1

Hello @Ming ,

Welcome to the Microsoft Q&A platform.

Typically, a GUID means that it was an application or service principal that performed the option. The best way to do that lookup is to use the AAD powershell cmdlets, Get-AzureADObjectByObjectId. The reason is that sometimes it is a Service Principal, sometimes it is an application. By using the command to get object ID, you cover both types.

Hope this helps. Do let us know if you any further queries.

---------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.