KQL – Get a list of users removed from an Entra ID group

I wanted to get a list of users recently removed from an Entra ID group. I can see the removals in the audit logs, but there’s easy way to add a column showing removals. Enter KQL. We are sending all audit logs to a Log Analytics workspace, so I queried this info that way. This … Continue reading KQL – Get a list of users removed from an Entra ID group