Function: List EntraID SignIn activities account

Description

This function can be used to list both the SigninLogs and AADNonInteractiveUserSignInLogs based on the account that has been given as intput (UserAccount).

Query · kql

let UserAccount = "test@test.com";
let aadFunc = (tableName: string, email: string) {
    table(tableName)
    | where ResultType == 0
    | where UserPrincipalName == email
};
let aadSignin = aadFunc("SigninLogs", UserAccount);
let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs", UserAccount);
union isfuzzy=true aadSignin, aadNonInt
// In case of all details remove line below
| project TimeGenerated, Category, Location, AppDisplayName, ClientAppUsed, RiskState
Raw source Function: List EntraID SignIn activities account · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Function: List EntraID SignIn activities account

## Query Information

#### Description
This function can be used to list both the *SigninLogs* and *AADNonInteractiveUserSignInLogs* based on the account that has been given as intput (*UserAccount*).

#### References
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs

## Sentinel
```
let UserAccount = "test@test.com";
let aadFunc = (tableName: string, email: string) {
    table(tableName)
    | where ResultType == 0
    | where UserPrincipalName == email
};
let aadSignin = aadFunc("SigninLogs", UserAccount);
let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs", UserAccount);
union isfuzzy=true aadSignin, aadNonInt
// In case of all details remove line below
| project TimeGenerated, Category, Location, AppDisplayName, ClientAppUsed, RiskState
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.