current_principal_details()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Returns details of the principal running the query.

Syntax

current_principal_details()

Learn more about syntax conventions.

Returns

The details of the current principal as a dynamic. The following table describes the returned fields.

Field Description
UserPrincipalName The sign-in identifier for users. For more information, see UPN.
IdentityProvider The source that validates the identity of the principal.
Authority The Microsoft Entra tenant ID.
Mfa Indicates the use of multi-factor authentication. For more information, see Access token claims reference.
Type The category of the principal: aaduser, aadapp, or aadgroup.
DisplayName The user-friendly name for the principal that is displayed in the UI.
ObjectId The Microsoft Entra object ID for the principal.
FQN The Fully Qualified Name (FQN) of the principal. Valuable for security role management commands. For more information, see Referencing security principals.
Country The user's country or region. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.
TenantCountry The resource tenant's country or region, set at a tenant level by an admin. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.
TenantRegion The region of the resource tenant. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.

Example

print details=current_principal_details()

Example output

details
{
"UserPrincipalName": "user@fabrikam.com",
"IdentityProvider": "https://sts.chinacloudapi.cn",
"Authority": "72f988bf-86f1-41af-91ab-2d7cd011db47",
"Mfa": "True",
"Type": "AadUser",
"DisplayName": "James Smith (upn: user@fabrikam.com)",
"ObjectId": "346e950e-4a62-42bf-96f5-4cf4eac3f11e",
"FQN": null,
"Notes": null
}