Office365/AzureAd last logon

Hi,

I am not sure if I can understand the request exactly but I will try to answer. I would like to first make a note that TimeGenerated is the time the log was generated. Keep in mind that there might be a different date/time column that shows the date of the login activity. With the above query you have pasted and specifically

| where TimeGenerated < ago(90d) 

you are actually taking all records that have happened before 90 days. So I think this is what you are actually requested.

You can do also additional things like

| where TimeGenerated < ago(90d) and TimeGenerated > ago(120d)

To do exact time frame.

Also to note that by default Log Analytics stores data for 31 days. If you want to go beyond you will need to extend the retention period of your Log Analytics workspace.

Let me know if this helps.