I need query that checks my AAD users list, and then shows me the accounts that have NOT logged in at all in the past 30 days. So far I have this that checks all users in my AAD, and checks them if they have a failed login attempt. I need 1 that shows if they haven't logged in at all.
SecurityEvent
| where EventID == 4625 and AccountType != "Machine"
| where Account contains "Telv" or Account contains "Selv"
| where TimeGenerated >= ago(30d)
| summarize count() by Account
