manual_changes.md•901 B
# Manual changes in last 30 days
```kql
resourcechanges
| extend operationTime = todatetime(properties.changeAttributes.timestamp)
| where operationTime > ago(30d)
| extend user = tostring(properties.changeAttributes.changedBy)
| extend operation = tostring(properties.changeAttributes.operation)
| extend resourceId = tostring(properties.targetResourceId)
| extend resourceGroup = tolower(extract('/resourceGroups/([^/]+)/', 1, resourceId))
// Optional: restrict to specific resource groups
// | where resourceGroup in~ ('rg-a','rg-b')
| where operation !in ('Microsoft.Compute/virtualMachines/restart/action', 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/deallocate/action')
| where user contains '@'
| project operationTime, resourceId, properties.targetResourceType, properties.changeType, resourceGroup, user, operation
| order by operationTime desc
```