How to use a watchlist instead of a dynamic list

tipper1510 

You can use it in many ways, perhaps like this?

// Look in conf access watch list for user name (User column) and compare to the UserPrincipalName in AAD SigninLogs
//
_GetWatchlist('Confidential-Access')
| join 
(
    SigninLogs 
    | summarize arg_max(TimeGenerated,*) by  UserPrincipalName
) on $left.User == $right.UserPrincipalName

or

// Use watchlist like a Table 
let conf_ = _GetWatchlist('Confidential-Access');
conf_
| count

// Use watchlist like a Table 
let conf_ = _GetWatchlist('Confidential-Access');
conf_
| where User startswith "megan"

See also https://secureinfra.blog/2020/10/07/how-to-obtain-and-import-data-into-the-azure-sentinel-watchlist-preview/