UserAccessAnalytics Schema #

Table description #

TableSection	TableType	TableSectionName	Description
Usx	Regular	Microsoft Sentinel	This analytics table, for a given user, provides the direct or transitive access to Azure resources. For example, if the user under investigation is Jane Smith, Access Analytics calculates all the Azure subscriptions that she either can access directly, via groups or serviceprincipals.

HotDays	ColdDays	TotalInteractiveDays
14	76	90

Name	Description	Type
_BilledSize		Double
_IsBillable		String
_ResourceId	A unique identifier for the resource that the record is associated with	String
_SubscriptionId	A unique identifier for the subscription that the record is associated with	String
AADTenantId	Unique identifier of the Azure Tenant	String
AccessEndReason	Reason why the source entity’s access to the target entity was revoked	String
AccessEndTime	Timestamp when the source entity’s access to the target entity was revoked	DateTime
AccessId	Unique identifier for the access between source and target entity	String
AccessLevel	The level of access that the source entity has to the target entity	String
AccessStartTime	Timestamp when the source entity was provided access to the target entity	DateTime
AccessType	The type of access that the source entity has to the target entity	String
SourceEntityId	Unique identifier of entity which has access to the target entity	String
SourceEntityName	Display name of entity which has access to the target entity	String
SourceEntityType	Type of entity which has access to the target entity	String
SourceSystem		String
TargetEntityId	Unique identifier of the entity which the source entity can access	String
TargetEntityName	Display name of the entity which the source entity can access	String
TargetEntityType	Type of the entity which the source entity can access	String
TenantId		String
TimeGenerated	Timestamp when the access analytics is calculated	DateTime
Type	The name of the table	String

Date	Action
2024-10-18	Table added to tracking