Skip to content

Instantly share code, notes, and snippets.

{
"version": "Notebook/1.0",
"items": [
{
"type": 1,
"content": {
"json": "# MFA Enforcement Dashboard\r\n\r\n1. Select the subscription where your workspace is.\r\n2. Select the workspace where your Entra ID Sign-In logs are.\r\n3. Select a time range (more than 14 days might take longer to display)\r\n4. Select all applications in the scope of the announcement or only specific applications.\r\n5. Display only successful connections (default) as failed connections are not indicative of actual accesses. "
},
"name": "TitleMd"
},
@piaudonn
piaudonn / ExportQueries.json
Created May 25, 2024 00:48
List and export Hunting queries
{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "01c4696f-3534-431f-abc6-2c62798620e0",
@piaudonn
piaudonn / ids
Last active October 13, 2025 07:28
First-party Microsoft service principal ids
ACOM Azure Website,23523755-3a2b-41ca-9315-f81f3f566a95
AEM-DualAuth,69893ee3-dd10-4b1c-832d-4870354be3d8
ASM Campaign Servicing,0cb7b9ec-5336-483b-bc31-b15b5788de71
Azure Advanced Threat Protection,7b7531ad-5926-4f2d-8a1d-38495ad33e17
Azure Data Lake,e9f49c6b-5ce5-44c8-925d-015017e9f7ad
Azure Lab Services Portal,835b2a73-6e10-4aa5-a979-21dfda45231c
Azure Portal,c44b4083-3bb0-49c1-b47d-974e53cbdf3c
AzureSupportCenter,37182072-3c9c-4f6a-a4b3-b3f91cacffce
Bing,9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7
CPIM Service,bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4
https://login.microsoftonline.com/common/UserRealm/?user=lea%40piesec.net&api-version=1.0
# Information from the Azure AD App Registration blade
# Required API permissions:
# - Device.Read.All
# - User.Read.All
$ClientID = "xxx"
$ClientSecret = "xxx"
$TenantId = "xxx"
# Get an access token for thr GraphAPI
$b = @{