query Azure AD signins

%3CLINGO-SUB%20id%3D%22lingo-sub-1262743%22%20slang%3D%22en-US%22%3Equery%20Azure%20AD%20signins%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1262743%22%20slang%3D%22en-US%22%3E%3CP%3EDears%2C%3C%2FP%3E%3CP%3EI%20would%20like%20to%20have%20a%20query%20to%20export%20the%20first%20signin%20for%20each%20user%20per%20day.%3C%2FP%3E%3CP%3Ei.e.%20i%20would%20like%20to%20know%20the%20first%20time%20this%20user%20signedin%20each%20day.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethank%20you%20for%20your%20support%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1262743%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1262955%22%20slang%3D%22en-US%22%3ERe%3A%20query%20Azure%20AD%20signins%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1262955%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F599935%22%20target%3D%22_blank%22%3E%40alid78%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-cpp%22%3E%3CCODE%3ESigninLogs%0A%7C%20where%20TimeGenerated%20%26gt%3B%20startofday(ago(0d))%0A%7C%20summarize%20Count%20%3D%20count()%20%2C%20arg_min(TimeGenerated%2C%20*)%20by%20UserDisplayName%0A%7C%20order%20by%20Count%20desc%2C%20UserDisplayName%20asc%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Earg_min%2C%20will%20finds%20the%20first%20occurrence%20for%20you.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Dears,

I would like to have a query to export the first signin for each user per day.

i.e. i would like to know the first time this user signedin each day.

 

thank you for your support

2 Replies
Highlighted

@alid78 

 

SigninLogs
| where TimeGenerated > startofday(ago(0d))
| summarize Count = count() , arg_min(TimeGenerated, *) by UserDisplayName
| order by Count desc, UserDisplayName asc

 

arg_min, will finds the first occurrence for you.  

Highlighted

@Clive Watson 

Working :), thank you dear. Appreciated.