Metrics Library

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1. SystemInfo.DirectorySync[?DaysSinceLastSync_r > 0 ] | length(@)

Detects corporate intune registered devices not encrypted.Outputs into CSV friendly format Devices[?intuneRegistered_r == true && accountEnabled == true && ownership_r == Corporate && isEncrypted == false ].deviceName | join( , , @)

You will need to customize the displayName in the query to the string you use to describe your MFA policy. For example if your policy name is Required MFA DUO then your metric would look like this instead Groups[?contains(~.Policies.ConditionalAccess[?displayName == Required MFA DUO ].conditions.users.excludeGroups[], id) ].displayName Groups[?contains(~.Policies.ConditionalAccess[?displayName == MFA Enforcement ].conditions.users.excludeGroups[], id) ].displayName

You will need to customize the displayName in the query to the string you use to describe your MFA policy. For example if your policy name is Required MFA DUO then your metric would look like this instead Users[?contains(~.Policies.ConditionalAccess[?displayName == Required MFA DUO ].conditions.users.excludeUsers[], id) ].displayName Users[?contains(~.Policies.ConditionalAccess[?displayName == Exchange Online Requires Compliant Device ].conditions.users.excludeUsers[], id) ].displayName

Returns the name, os system, os version, and encryption status of the device in Azure AD. Devices[].[displayName, operatingSystem, operatingSystemVersion, isEncrypted]

Returns the number of users assigned to group. This is a contains function, so you don't need to be exact. Users[?contains(to_string(assignedGroups[]), 'Group')].displayName | length(@)

This is good to identify clients with a service or services.If looking for 2 services:SecureScore[?contains(enabledServices, HasAaADP1 ) || contains(enabledServices, HasAaADP2 )] && SystemInfo.Overview.CompanyName SecureScore[?contains(enabledServices, HasAADP2 )] && SystemInfo.Overview.CompanyName

The DisplayName will need to be edited to match the string you use for your MFA enforcement policy, so for Example if yours is called Require DUO MFA the string metric would read Groups[?contains(~.Policies.ConditionalAccess[?displayName == Require DUO MFA ].conditions.users.includeGroups[], id) ].displayName Groups[?contains(~.Policies.ConditionalAccess[?displayName == Enforced MFA ].conditions.users.includeGroups[], id) ].displayName

You will need to customize the displayName in the query to the string you use to describe your MFA policy. For example if your policy name is Required MFA DUO then your metric would look like this instead Users[?contains(~.Policies.ConditionalAccess[?displayName == Required MFA DUO ].conditions.users.includeUsers[], id) ].displayName Users[?contains(~.Policies.ConditionalAccess[?displayName == Required MFA DUO ].conditions.users.includeUsers[], id) ].displayName

Returns a list of Azure Active Directory/Entra ID Risk Detections RiskDetections[].['---'userDisplayName, '-'userPrincipalName,'-' riskEventType ,'-'locationStr, '-'activityDateTime]