current_principal_details()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns details of the principal running the query.

Syntax

current_principal_details()

The details of the current principal as a dynamic. The following table describes the returned fields.

Field	Description
UserPrincipalName	The sign-in identifier for users. For more information, see UPN.
IdentityProvider	The source that validates the identity of the principal.
Authority	The Microsoft Entra tenant ID.
Mfa	Indicates the use of multi-factor authentication. For more information, see Access token claims reference.
Type	The category of the principal: `aaduser`, `aadapp`, or `aadgroup`.
DisplayName	The user-friendly name for the principal that is displayed in the UI.
ObjectId	The Microsoft Entra object ID for the principal.
FQN	The Fully Qualified Name (FQN) of the principal. Valuable for security role management commands. For more information, see Referencing security principals.
Country	The user's country or region. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.
TenantCountry	The resource tenant's country or region, set at a tenant level by an admin. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.
TenantRegion	The region of the resource tenant. This property is returned if the information is present. The value is a standard two-letter country or region code, for example, FR, JP, and SZ.

print details=current_principal_details()

Example output

details
{ "UserPrincipalName": "user@fabrikam.com", "IdentityProvider": "https://sts.chinacloudapi.cn", "Authority": "72f988bf-86f1-41af-91ab-2d7cd011db47", "Mfa": "True", "Type": "AadUser", "DisplayName": "James Smith (upn: user@fabrikam.com)", "ObjectId": "346e950e-4a62-42bf-96f5-4cf4eac3f11e", "FQN": null, "Notes": null }