Forum Discussion
KQL SiginLogs
Hi Everyone, i ask you a question from basilar KQL " SigninLogs | Project Id,UserId,Identity" i receive correctly the events, but in some case in the Identity coloum receive an ID in this format xxx...
Deleted
Identity is the actor logging in which can be the GUID of an App
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs
Check the AppDisplayName
e.g.
Deleted usually this will happen when the sign-in activity is not completely succesful, look at the result type, just remember to summarize or filter by UserId if you want ALL activity to appear.