Top 100 users that have the most interactive sign ins
Description
Visualize the top 100 users that have performed the most interactive sign ins.
Query · kql
IdentityLogonEvents | where LogonType == 'Interactive' | where isempty(FailureReason) | distinct AccountUpn, DeviceName | summarize TotalUniqueInteractiveSignIns = count() by AccountUpn | top 100 by TotalUniqueInteractiveSignIns | render columnchart with (title="Top 100 users that have the most interactive sign ins")