Link Audit logs to Groups or Role or Privilege

Question

I am wondering how can I link the audit logs from Azure AD to Role, Group or Privilege?

The logs just have the action and the category. Is there a way by which I can understand using what Role or Group privilege this action was taken?

Answer 1

@Swapnil Khamkar, Thanks for posting in Q&A. Based on my researching, there is no direct way to link audit logs to a specific role, group, or privilege, you can use the information provided in the logs to determine who initiated the action ("Initiated by" field) and "Target(s)" field which targets were affected.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/monitor-audit-logs#use-audit-logs-to-track-and-monitor-events-in-microsoft-intune

Meanwhile, you can feedback in the following link to request the feature and see if we can get this in the future:

https://feedbackportal.microsoft.com/feedback/forum/ef1d6d38-fd1b-ec11-b6e7-0022481f8472

Best regards.

Crystal

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Is there a way in which I can map the category or its description with the privilege or its description