Log Analytics query filter select multiple accounts

New Contributor



I want to setup a query and create an alert for (failed) signin attempts of multiple service accounts. I collect the signin attempts in Log Analytics and use this query to filter:


SigninLogs | where OperationName == "Sign-in activity" | where UserPrincipalName == ""


The problem is, I want to use this for multiple service accounts and I can't use a wildcard like auobrien.* for example. Any idea's on how to specify multiple accounts or do I have to create a query for each account I want to monitor?

4 Replies

@marwedit, would something like this be OK?



| where OperationName == "Sign-in activity" and UserPrincipalName in~ ('','','')

@hspinto Thanks for the reply! I tried it and it works great. Thanks! This tackles the multiple query problem since I can put multiple users in one. One more question. Do you know of a way I could enter a wildcard in the filter so new service accounts (svc_*) are automatically added? When I replace part of the username with * it just ignores it.

best response confirmed by marwedit (New Contributor)

@marwedit, you just have to add a different condition to the query:



| where OperationName == "Sign-in activity" and (UserPrincipalName in~ ('','','') or UserPrincipalName startswith "svc_")


See here a full list of the string operators you can use.


Hope that helps!

@hspinto Thanks for the help and the link. This is exactly what I was looking for.