Using Log Analytics workspace to record Windows VM logins.

NathanQGE 

Go to Log Analytics and run query

It 'looks' like you don't have the SecurityEvent table in your workspace yet - to connect this you need to point Azure Security Center - Standard (not free) to the workspace you are running that query. 

You can test the syntax in the free workspace (see link above)

https://docs.microsoft.com/en-us/azure/security-center/security-center-data-security

and 

https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection#data-collection-tier