AzureAD Audit Logs CorrelationID - Returns two entries with the same correlation ID but different Directory_ID - azure-active-directory

We have a dynamic user group, users are added to this group automatically based on department. I wanted to check a particular audit log, I used PowerShell to get the audit log using correlationId and it returned two values with a different Audit ID but same correlationID. I assumed that correlationId's are unique per activity.
Value 1:
id: Directory_f606e2f6-4f88-43bb-8172-83e945533d1f_6LW2D_26019271
correlationId:f606e2f6-4f88-43bb-8172-83e945533d1f
targetResources: {id=9f9ee398-e2d2-4e5b-949f-7e79ce0087c0}
Value 2:
id: Directory_f606e2f6-4f88-43bb-8172-83e945533d1f_6LW2D_26019272
correlationId:f606e2f6-4f88-43bb-8172-83e945533d1f
targetResources: {id=9f9ee398-e2d2-4e5b-949f-7e79ce0087c0}
please assist me if you have come across this situation.

I tried to reproduce the same in my environment.
Commands:
$logs=Get-AzureADAuditDirectoryLogs -All $true
$logs.CorrelationId
Commands:
$logs=Get-AzureADAuditDirectoryLogs -top 10
$logs.CorrelationId
write-host "Id"
$logs.Id
write-host "CorrelationId"
$logs.CorrelationId
write-host " "
Output:
Even for different directory audit logs , correlation Id seems same for the next coming audits of related event .
It is because each of the audit logs has and “ID” and “CorrelationID where this correlation ID is useful in finding related audit events.The audit events have same correlation ID.
It suggests the child events are taking the parent correlation Id in order to find out or investigate the originating events or its related events.
Also check the limitation in the given reference
Reference : azure-devops-auditing · GitHub

Related

Issue loading data to Dynamics D365 using Azure Data Factory

I have the following issue in a copy activity:
"Code": 23605,
"Message": "ErrorCode=DynamicsOperationFailed,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Dynamics operation failed with error code: -2147088238, error message: A record that has the attribute values SAP Client, SAP System Id, OrderPOS-ID, Order ID, SAP Module, Account Assignment ID already exists. The entity key Purchase Order Atl Key requires that this set of attributes contains unique values. Select unique values and try again..,Source=Microsoft.DataTransfer.ClientLibrary.DynamicsPlugin,''Type=System.ServiceModel.FaultException`1[[Microsoft.Xrm.Sdk.OrganizationServiceFault, Microsoft.Xrm.Sdk, Version=9.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]],Message=The creator of this fault did not specify a Reason.,Source=Microsoft.DataTransfer.ClientLibrary.DynamicsPlugin,'";
I'm using a dynamic query(with a store procedure) and load that based on config table where i have all entities to load. And Recently we start to get this error messages for some countries(but there's no pattern). The entity in this case is Purchase Orders and the processes load part of the data to dynamics, but some countries are failing. I've already checked all possible duplicates and I didn't find none using the keys presented in message above;
This fields are defined as alternatekeys on dynamics in order to avoid duplicates, and the alternatekey are composed with: SAP Client, SAP System Id, OrderPOS-ID, Order ID, SAP Module, Account Assignment ID;
In order to make our process faster I separate PO(PurchaseOrders) in 2 view: (1)Purchase_Order_master : basically copy to dynamics new records with all keys and after this first view run we have the (2)view that got all attributes and do the upsert of all values that suffered some update on source side.
In this 2 view we have the following field in common, these are the only fields in common
sie_purchaseordersid(uniqueidentifier, null)
Executionid(uniqueidentifier, not null)
Hashkey(varbinary(32), not null)
The fields that compose the hashkey are the same that we can find on the alternate key
,HASHBYTES('SHA2_256', CONCAT(SAPSYSID,SAPMOD,MANDT,EBELN,EBELP,TRY_CONVERT(NVARCHAR(255),TRY_CONVERT(INT,ZEKKN)))) HashKey
I don't have more ideas, and i hope one of you already tackled a similar issue in a passed and can provide some help.
Thanks in advance
I've try to find duplicates based on the fields that were mention in log message, but i didn't find nothing;

Azure Search Delete - Is there any way to specify conditions for the delete?

I have documents that are "owned" by particular users. The documents have the user id in a "userId" field.
I would like to issue a Delete command for a document, but also specifying conditions, for example (pseudo code) DELETE WHERE id = #documentId AND userId = #userId.
Currently the only way I can think to do this is I first issue a search SELECT WHERE id = #documentId AND userId = #userId. If I get back a document, then I know the document is owned by the expected user so I issue the delete command DELETE WHERE id = #documentId. But that requires two trips on the wire and I would prefer some way to do it in one trip.
Is there any way to do this in one command?
Currently, deleting a document is only possible via specifying its id. You seem to be asking for the more general "delete by query" functionality - please vote for this UserVoice suggestion to help us prioritize this feature. Thanks!

Model datastore application

I am looking how to create an efficient model which will satisfy the requirements I put below. I have tried using gcloud-node but have noticed it has limitations with read consistencies, references, etc. I would prefer to write this is nodejs, but would be open to writing in java or python as long as it would improve my model. I am building around the new pricing model which will come July 1st.
My application consists of a closed email system. In essence what happens is users register to the site. These user's can make friends. Then they can send emails to each other.
Components of the app:
Users - Unlimited amount of users can join.
Friends - A User can have 200 confirmed friends and 100 pending friend requests. When a friendlist is retrieved it should show the name of the friend. (I will also need to receive the id of the friends so I can use it on my client side to create emails).
Emails - Users can send emails to their friends and they can receive emails from their friends. The user can then view all their sent emails independently(sentbox) and all their received emails independently(inbox).
They can also view the the emails sent between themselves and a friend order by newest. The emails should show the senders and receivers names. Once an email is read it needs to be marked as read.
My model looks something like this, but as you can see their are inefficiencies.
Datastore Kinds:
USER
-email (id) //The email doesn't need to be the id, but I need to be able to retrieve users by their email
-hash_password
-name
-account_status
-created_date
FRIEND
-id (auto-generated)
-friend1
-friend2
-status
EMAIL
-id (auto-generated)
-from
-to
-mutual_id
-message
-created_date
-has_seen
Procedures of the application:
Register - Get operation to see if a user with this email exists. If does not insert key.
Login - Get operation to get user based on email. If exists retrieve the hash_password from the entity and compare to user's input.
Send friend request - Friend data will be written twice for every relationship. Then using the index on friend1 and index on status I will query all the friends for a user and filter only those which are 'pending'. I will then count these friends and see if they are over X. Again I will do this for the other user. If they are both not over the pending limit, I will insert the friend request. This needs to run in a transaction.
Accept a friend request - Friend data will be written twice for every relationship. Then using the index on friend1 and index on status I will query all the friends for a user and filter only those which are pending. I will then count these friends and see if they are over X. Again I will do this for the other user. If they are both not over the pending limit, I will change both entities's status to accepted as a transaction.
Show confirmed friends - Friend data will be written twice for every relationship. Then using the index on friend1 and index on status I will query all the friends for a user and filter only those which are accepted. Not sure how I will show the friend's names (e.g what happens if a user changed their name this needs to be reflected in all friend relationships and emails!).
Show pending friends - Friend data will be written twice for every relationship. Then using the index on friend1 and index on status I will query all the friends for a user and filter only those which are pending. Not sure how I will show the friend's names (e.g what happens if a user changed their name this needs to be reflected in all friend relationships and emails!).
View sent emails - Using the index on the from property I would query to get all the sent emails from a user 5 at a time ordered by created_date (newest first). (e.g what happens if a user changed their name this needs to be reflected in all friend relationships and emails!).
View received emails - Using the index on the to property I would query to get all the received emails to a user 5 at a time ordered by created_date (newest first). When a emails is seen it will update that entities has_seen property to true. (e.g what happens if a user changed their name this needs to be reflected in all friend relationships and emails!).
View emails between 2 users - Using the index on mutual_id which is based on [lower_lexicographic_email]:[higher_lexicographic_email] to query the mutual emails. Ordered by newest, 5 at a time. (e.g what happens if a user changed their name this needs to be reflected in all friend relationships and emails!).
Create email - Using the friend1 and status index I will confirm the user's are friends. If they are friends, I will insert an email.

Laravel 5.2 update last created record

I am new to laravel, I have tried a bunch of recommendations but none have worked for what I need. Do to requirements for design I am splitting my registration into two tables artist and the normal user table. The problem is email verification is done through the artist table. After that process has been completed I would simply like to update the last created user in the user table from 0 to 1 in the active column.
I can not figure out how to get this to work.
return $this->users()->where('verified')->first()->verified()- >orderBy('created_at', 'desc')->first();
Then ran update didn't work
User::orderby('created_at', 'desc')->first();
Then tried update didn't work
$user = User::find(1)->verified()- >update(array(
'Verified' => '1'
));
Non of the above have worked. Any suggestions are appreciated.
Given your requirements, and the way you are doing things - you are creating a user during registration (in the users table and setting verified to 0) and then putting some of their information in an artists table until they are verified.
I would add a users_id column to your artists table and set the value of this to the id of the newly created user.
When they verify, you can find their information in your artists table using their user_id and then move it anywhere you need to.

Social Network Activity Feed + Groups

I'm working on an social network app and want to create an activity feed so people can keep up to date with all of their connections (classic facebook stream). I have a DB table called activity setup for this like so:
activity_id (int)
user_id (int) //who posted it
group_id (int) //the group of connections that have permission to view
type (enum) //the type of activity performed
time (datetime) //the time the activity was performed
I would then do a select * from activity where user_id in (connections) to get the latest news.
Here's the catch. User's activities do not always have visibility to the complete set of connections. Users can create groups of user ids to form smaller sets within their super set of connections. Its like how facebook allows you to specify who sees a particular post instead of allowing all friends to see it.
I have a separate groups table setup with the following schema:
group_id (int)
connection_id (user_id, int)
user_id (group creator)
I have a group_id in my activity table. The group_id is the link to the subset of connections that have permission to see the post.
My question is, what is the best way to do this type of feed, and is there an optimal single select statement that will get me the output desired (a list of my connections activities that I have been granted permission to see)?
Thanks.
If you're open to offloading your activity stream functionality to a service via an API, Collabinate (http://www.collabinate.com) may be useful to you.

Resources