Finding out what info on a deleted ObjectID

Question

Finding out what info on a deleted ObjectID

H Raja 346

I have an object that has been deleted, but can't seem to find out what it was i.e. user. service principal or managed identity. I have tried to run a KQL to check logs, but no luck :-(

Any ideas of how I can find out what it was linked. I've checked deleted users, subscriptions and groups. Any KQL I can run to see what this initial object was.

AuditLogs

| where TargetResources has "<ObjectID>" or tostring(InitiatedBy.app.appId) == "<ObjectID>"

| project TimeGenerated, ActivityDisplayName, OperationName, InitiatedBy, TargetResources
| sort by TimeGenerated desc
Delete

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello H Raja,

Whenever a user, service principal, or group that has an Azure RBAC role assignment at the management group, subscription, or resource level is deleted in Microsoft Entra ID without first removing the RBAC assignment, you may notice that the security principal is shown as Identity not found with an Unknown type. Please refer to the screenshot from my test tenant below.

User's image

To confirm whether these assignments are safe to remove: whenever you see an RBAC assignment with an Unknown type, it means the object no longer exists in the tenant and it is safe to delete the role assignment without any issues.

For more information, please refer to the public documentation below:

Role assignments with Identity not found with an Unknown type

User's image

Note: As these objects were already deleted from your directory there is no way that we can find out that information.

I hope this information is helpful. Please feel free to reach out if you have any further questions.