Forum Discussion
Sentinel KQL Query to retrieve last sign-in date.
Can someone take a look at my queries and see if they can find any errors please? My original query below provides as output all disabled accounts for the previous month and includes the admin who t...
Hello
a tip that can also help you, if your computers are join in azure maybe use the audit table to get deactivated users and then use union with Signlogs to see the last login wouldn't it be easier?
if you liked it mark the answer with a like.
if you thought this answer helped in any way please mark it as best answer