Azure Data, Detected Apps, Diagnostics, Directory, Disks, Enterprise Apps, Events, Firewalls, and Front Door Tables

Tables

AzureADDataLakeAccounts

Azure Data Lake Store account resources, including their state, endpoint, and creation details.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration related to the Data Lake account.
ID	string	The unique identifier for the Data Lake account.
Name	string	The name of the Data Lake account.
Type	string	The type of the resource for the Data Lake account.
PropertiesProvisioningState	string	The state of provisioning for the Data Lake account (e.g., `succeeded`, `failed`).
PropertiesState	string	The current state of the Data Lake account (e.g., `active`, `disabled`).
PropertiesCreationTime	datetime	The date and time when the Data Lake account was created.
PropertiesLastModifiedTime	datetime	The date and time when the Data Lake account was last modified.
PropertiesEndpoint	string	The endpoint URL for accessing the Data Lake account.
PropertiesAccountId	string	The unique identifier for the Data Lake account.
BatchDate	datetime	The date and time when the data was last processed or updated.

AzureADDataProtectionBackupVaults

Azure Backup vault resources, including storage, security, and provisioning settings.

Name	Type	Description
ID	string	The unique identifier for the backup vault.
IdentityType	string	The type of identity associated with the backup vault (e.g., `Managed Identity`, `User Identity`).
Name	string	The name of the backup vault.
Type	string	The type of the resource (e.g., `backupVault`).
Location	string	The Azure region where the backup vault is located.
Tags	string	Any tags associated with the backup vault.
PropertiesProvisioningState	string	The current provisioning state of the backup vault (e.g., `succeeded`, `failed`).
JsonPropertiesStorageSettings	string	JSON string containing the storage settings for the backup vault.
JsonPropertiesFeatureSettings	string	JSON string containing the feature settings for the backup vault.
PropertiesSecuritySettingsState	string	The state of the security settings for the backup vault (e.g., `enabled`, `disabled`).
PropertiesSecuritySettingsRetentionDurationInDays	integer	The retention duration in days for the security settings of the backup vault.
PropertiesSecureScore	string	The secure score associated with the backup vault, indicating its security posture.
PropertiesBcdrSecurityLevel	string	The business continuity and disaster recovery (BCDR) security level set for the backup vault.
ConfigID	integer	The unique identifier for the configuration of the backup vault.
BatchDate	datetime	The date and time when the data was last processed or updated.

AzureADDataProtectionJobs

Backup and restore job records executed against Azure Backup vaults.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration of the data protection job.
ID	string	The unique identifier for the data protection job.
Type	string	The type of resource (e.g., `DataProtectionJob`).
PropertiesActivityID	string	The ID associated with the activity within the backup job.
PropertiesSubscriptionId	string	The Azure subscription ID associated with the backup job.
PropertiesBackupInstanceId	string	The ID of the `backup` instance related to this job.
PropertiesPolicyId	string	The ID of the backup policy that applies to the job.
PropertiesDataSourceId	string	The unique identifier of the data source being backed up.
PropertiesVaultName	string	The name of the backup vault associated with the job.
PropertiesBackupInstanceFriendlyName	string	The user-friendly name for the `backup` instance.
PropertiesPolicyName	string	The name of the backup policy applied to the job.
PropertiesSourceResourceGroup	string	The source resource group in which the backup job was executed.

AzureADDetectedApps

Applications detected as installed on managed devices by Intune.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration of the detected app.
DetectedAppID	string	The unique identifier of the detected application in Azure AD.
DisplayName	string	The display name of the detected application.
ODataType	string	The OData type for the detected application (e.g., an identifier used for OData API).
DeviceCount	integer	The number of devices where the detected application is installed or in use.
Publisher	string	The publisher or developer of the detected application.
Version	string	The version number of the detected application.
SizeInByte	bigint	The size of the detected application in bytes.
BatchDate	datetime	The date and time when the data was last processed or updated.

AzureADDetectedApps_AzureADManagedDevices

Junction table linking detected applications to the managed devices they were found on.

Name	Type	Description
DetectedAppID	string	The unique identifier of the detected application within Azure AD.
DeviceID	string	The unique identifier of the device on which the detected application is installed or in use.
ConfigID	integer	The unique identifier for the configuration associated with the detected application and the managed device.

AzureADDeviceCompliancePolicies

Intune device compliance policy definitions applied to managed devices.

Name	Type	Description
ID	string	Intune device compliance policy id (PK with ConfigID)
ConfigID	integer	Azure integration config that collected the row (PK with ID)
DisplayName	string	Policy name
Description	string	Policy description
Version	integer	Policy version number
CreatedDateTime	datetime	When the policy was created
LastModifiedDateTime	datetime	When the policy was last modified
OdataType	string	Graph derived type (e.g. #microsoft.graph.windows10CompliancePolicy)
RoleScopeTagIds	string(max)	Serialized Intune scope tag ids; Graph v1.0 does not populate this
BatchDate	datetime	UTC timestamp of the ETL load that wrote the row

AzureADDeviceCompliancePolicyDeviceStatuses

Per-device compliance status results against assigned Intune compliance policies.

Name	Type	Description
ID	string	Per-device compliance status row id (PK with ConfigID)
ConfigID	integer	Azure integration config that collected the row (PK with ID)
PolicyID	string	Parent compliance policy id
DeviceDisplayName	string	Device display name reported for this status
DeviceModel	string	Device model
Platform	string	Device platform; Graph v1.0 does not populate this
Status	string	Compliance status (Compliant, Noncompliant, etc.)
UserPrincipalName	string	UPN of the user associated with the device status
LastReportedDateTime	datetime	Last time the device reported compliance for this policy
ComplianceGracePeriodExpirationDateTime	datetime	When the compliance grace period ends
BatchDate	datetime	UTC timestamp of the ETL load that wrote the row

AzureADDiagnosticSettingLogs

Log category configuration entries within an Azure resource's diagnostic settings.

Name	Type	Description
ID	string	The unique identifier for the diagnostic setting log.
AzureDiagnosticSettingID	integer	The identifier of the diagnostic setting associated with the log.
Category	string	The category of the log (e.g., `AuditLogs`, `Sign-ins`).
CategoryGroup	string	The group of categories under which the diagnostic logs are organized.
StorageAccountId	string	The identifier of the Azure Storage account where the diagnostic logs are stored.
Enabled	boolean	A boolean indicating whether the diagnostic setting is enabled (`true`) or not (`false`).
RetentionPolicyEnabled	boolean	A boolean indicating whether the retention policy for the logs is enabled (`true`) or not (`false`).
RetentionPolicyDays	integer	The number of days for which the diagnostic logs are retained based on the retention policy.
BatchID	integer	The unique identifier of the batch of logs within the diagnostic setting.
BatchDate	datetime	The date and time when the batch of logs was generated or processed.
ConfigID	integer	The identifier for the configuration associated with the diagnostic setting log.

AzureADDiagnosticSettings

Diagnostic settings configured on Azure resources for routing logs and metrics.

Name	Type	Description
ID	string	The unique identifier for the diagnostic setting.
AzureKeyVaultID	integer	The identifier of the Azure Key Vault associated with the diagnostic setting.
Name	string	The name of the diagnostic setting.
Type	string	The type of the diagnostic setting (e.g., `Microsoft.Insights`, `diagnosticSettings`).
ResourceType	string	The type of resource to which the diagnostic settings are applied (e.g., `Virtual Machines`).
Location	string	The Azure region where the diagnostic settings are applied.
BatchID	integer	The unique identifier for the batch of diagnostic settings being processed.
BatchDate	datetime	The date and time when the batch of diagnostic settings was created or updated.
ConfigID	integer	The identifier of the configuration associated with the diagnostic settings.

AzureADDirectoryRoles

Azure AD directory role instances activated in the tenant.

Name	Type	Description
ConfigID	integer	The identifier of the configuration associated with the directory role.
ID	string	The unique identifier for the directory role.
DeletedDateTime	datetime	The date and time when the directory role was deleted, if applicable.
Description	string	A brief description of the directory role.
DisplayName	string	The display name of the directory role, as it appears in Azure AD.
RoleTemplateId	string	The identifier of the role template associated with the directory role.
BatchDate	datetime	The date and time when the batch of directory roles was created or updated.

AzureADDiskEncryptionSets

Disk Encryption Set resources used to encrypt managed disks with customer-managed keys.

Name	Type	Description
ConfigID	integer	The identifier of the configuration associated with the disk encryption set.
ID	string	The unique identifier for the disk encryption set.
IdentityType	string	The type of identity associated with the disk encryption set (e.g., system-assigned or user-assigned identity).
ActiveKeySourceVaultId	string	The identifier of the key vault where the encryption key is stored.
ActiveKeyKeyUrl	string	The URL of the active key used for disk encryption in the set.
EncryptionType	string	The type of encryption used (e.g., Azure-managed keys or customer-managed keys).
ProvisioningState	string	The current provisioning state of the disk encryption set (e.g., `Succeeded`, `failed`, `Updating`).
Type	string	The type of resource, which for disk encryption sets is typically `Microsoft.Compute`, `diskEncryptionSets`.
Location	string	The Azure region where the disk encryption set is deployed.
TagsDepartment	string	A tag used to categorize the disk encryption set, such as the department associated with it.
TagsProject	string	A tag used to categorize the disk encryption set, such as the project associated with it.
Name	string	The name of the disk encryption set.
BatchDate	datetime	The date and time when the batch of disk encryption sets was created or updated.

AzureADDisks

Azure managed disk resources, including encryption, network access, and state.

Name	Type	Description
ID	string	The unique identifier of the disk.
Name	string	The name of the disk.
Location	string	The Azure region where the disk is located.
EncryptionType	string	The type of encryption used on the disk (e.g., `Azure-managed`, `customer-managed`).
NetworkAccessPolicy	string	The policy governing access to the disk over the network (e.g., allowing or blocking public network access).
PublicNetworkAccess	string	Indicates whether the disk is accessible via public network access (e.g., `enabled`, `disabled`).
DiskState	string	The current state of the disk (e.g., `Ready`, `Provisioning`, `Deallocated`).
BatchID	integer	The identifier for the batch in which the disk operation is performed.
BatchDate	datetime	The date and time when the batch containing the disk operation was executed.
ConfigID	integer	The identifier for the configuration associated with the disk.

AzureADEnterpriseApps

Enterprise application (service principal) objects registered in the tenant.

Name	Type	Description
ID	string	The unique identifier for the enterprise application.
AppId	string	The unique application ID associated with the enterprise application (GUID).
DisplayName	string	The display name of the enterprise application.
BatchID	integer	The identifier for the batch in which the enterprise application operation is performed.
BatchDate	datetime	The date and time when the batch containing the enterprise application operation was executed.
ConfigID	integer	The identifier for the configuration associated with the enterprise application.

AzureADEventGridDomains

Azure Event Grid domain resources used to manage groups of custom topics.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Event Grid domain.
ID	string	The unique identifier for the Event Grid domain.
PropertiesEndpoint	string	The endpoint for the Event Grid domain.
PropertiesProvisioningState	string	The provisioning state of the Event Grid domain (e.g., `succeeded`, `failed`).
Location	string	The location (region) where the Event Grid domain is deployed.
Name	string	The name of the Event Grid domain.
Tag1	string	Custom tag 1 associated with the Event Grid domain.
Tag2	string	Custom tag 2 associated with the Event Grid domain.
Type	string	The type of resource (e.g., `Microsoft.EventGrid`, `domains`).
BatchDate	datetime	The date and time when the batch containing the Event Grid domain data was processed.

AzureADEventHubNamespaces

Azure Event Hubs namespace resources, including SKU, encryption, and network configuration.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Event Hub namespace.
ID	string	The unique identifier for the Event Hub namespace.
SkuName	string	The SKU name for the Event Hub namespace (e.g., `Standard`, `Basic`).
SkuTier	string	The tier of the Event Hub namespace (e.g., `Standard`, `Premium`).
SkuCapacity	integer	The capacity of the Event Hub namespace (typically refers to throughput units).
Type	string	The type of the resource (e.g., `Microsoft.EventHub`, `namespaces`).
Location	string	The region where the Event Hub namespace is deployed.
IdentityPrincipalId	string	The principal ID of the identity assigned to the Event Hub namespace.
IdentityTenantId	string	The tenant ID of the identity assigned to the Event Hub namespace.
IdentityType	string	The type of identity (e.g., `SystemAssigned`, `UserAssigned`) for the Event Hub namespace.
IdentityUserAssignedIdentity	string	The ID of the user-assigned identity associated with the Event Hub namespace, if any.
PropertiesIsAutoInflateEnabled	boolean	Indicates whether auto-inflateis enabled for the Event Hub namespace (auto-inflate increases throughput).

AzureADFirewallPolicies

Azure Firewall Policy resources, including rule collection groups and threat intelligence settings.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Azure Firewall policy.
ID	string	The unique identifier for the Azure Firewall policy.
Name	string	The name of the Azure Firewall policy.
Type	string	The type of the resource (e.g., `Microsoft.Network`, `firewallPolicies`).
Etag	string	The entity tag (ETag) used for concurrency control when updating the Firewall policy.
Location	string	The region where the Firewall policy is deployed.
TagsKey1	string	Custom key for tagging the Firewall policy (used for organization and management).
JsonPropertiesProvisioningState	string	The provisioning state of the Firewall policy (e.g., `succeeded`, `failed`, `updating`).
JsonPropertiesThreatIntelMode	string	Specifies the mode for threat intelligence (e.g., `Alert`, `Deny`) used by the Firewall policy.
JsonPropertiesRuleCollectionGroups	string	A JSON representation of the rule collection groups configured for the Firewall policy.
JsonPropertiesFirewalls	string	A JSON representation of the associated firewalls with the Firewall policy.
ListPropertiesSnat	string	A list of SNAT (Source Network Address Translation) settings applied to the Firewall policy.
PropertiesSqlAllowSqlRedirect	boolean	A boolean value indicating whether SQL redirects are allowed by the Firewall policy.
JsonPropertiesDnsSettings	string	A JSON representation of DNS settings for the Firewall policy.
PropertiesSkuTier	string	The SKU tier of the Firewall policy (e.g., `Standard`, `Premium`).
BatchDate	datetime	The date and time when the batch containing the Firewall policy data was processed.

AzureADFirewalls

Azure Firewall resources, including their IP configuration, rule collections, and provisioning state.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Azure Firewall.
ID	string	The unique identifier for the Azure Firewall resource.
Type	string	The type of the resource (e.g., `Microsoft.Network`, `azureFirewalls`).
Etag	string	The entity tag (ETag) used for concurrency control when updating the Firewall resource.
Location	string	The region where the Azure Firewall is deployed.
Zones	string	The availability zones where the Azure Firewall is deployed (if applicable).
TagKey	string	Custom key for tagging the Azure Firewall (used for organization and management).
PropertiesProvisioningState	string	The provisioning state of the Firewall resource (e.g., `succeeded`, `failed`, Updating).
PropertiesThreatIntelMode	string	Specifies the mode for threat intelligence (e.g., `Alert`, `Deny`) used by the Firewall.
PropertiesIpConfigurations	string	A JSON representation of IP configurations for the Firewall.
PropertiesManagementIpConfiguration	string	A JSON representation of the management IP configuration for the Firewall.
PropertiesApplicationRuleCollections	string	A JSON representation of application rule collections in the Firewall configuration.

AzureADFrontDoors

Azure Front Door classic profiles, including routing rules, backend pools, and health probes.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Azure Front Door.
ID	string	The unique identifier for the Azure Front Door resource.
Type	string	The type of the resource (e.g., `Microsoft.Network`, `frontDoors`).
Location	string	The region where the Azure Front Door resource is deployed.
Tag1	string	Custom tag key used for organizing and managing the Front Door resource.
Tag2	string	Additional custom tag key used for organizing and managing the Front Door resource.
RoutingRules	string	A JSON representation of routing rules applied to the Azure Front Door configuration.
HealthProbeSettings	string	A JSON representation of health probe settings for backend health monitoring.
LoadBalancingSettings	string	A JSON representation of load balancing settings used by the Front Door.
BackendPools	string	A JSON representation of backend pools configured for the Azure Front Door.
FrontendEndpoints	string	A JSON representation of frontend endpoints configured for the Azure Front Door.
BackendPoolsSettings	string	A JSON representation of settings related to backend pools in the Front Door configuration.