Forum Discussion
Assistance Needed with KQL Script for Last Sign-in of Users
Dear Microsoft Community, I hope this message finds you well. I am reaching out for assistance with a Kusto Query Language (KQL) script that I've been working on to retrieve the last sign-in of ...
Does this meet your requirement?
Note that I commented line 8 for testing purposes.
SigninLogs
| where TimeGenerated > ago(30d)
| extend DeviceId = tostring(parse_json(DeviceDetail).deviceId),
DeviceDisplayName = tostring(parse_json(DeviceDetail).displayName),
OperatingSystem = tostring(parse_json(DeviceDetail).operatingSystem),
LocationDetailsString = tostring(LocationDetails),
UserDomain = tostring(split(UserPrincipalName, "@")[1])
//| where UserDomain == "acme.com
| extend City = tostring(parse_json(LocationDetailsString).city),
State = tostring(parse_json(LocationDetailsString).state),
CountryOrRegion = tostring(parse_json(LocationDetailsString).countryOrRegion)
| summarize arg_max(TimeGenerated, *) by UserPrincipalName
| project UserPrincipalName, City, State, CountryOrRegion, DeviceDisplayName, OperatingSystem, AppDisplayName, ResourceDisplayName