Guest user account sign-ins

[Graham_Sparky_Harrison]

Hello,

We have log analytics setup and i am trying to create a new query in Kusto Query Language to find user type=guest that have not signed in for more than 60 days. Please can anyone assist?

kind regards,

Graham

[#2]

@Graham_Sparky_Harrison 

Can I assume you have the SigninLogs Table, to check - is this AAD? 
You may also want to uncomment line #4 if you want to check just for successful sign-ins?

SigninLogs
| where TimeGenerated > ago (90d)
| where UserType == "Guest"
//| where ResultType == 0
| summarize arg_max(TimeGenerated,*) by UserPrincipalName
| extend LastSignin = datetime_diff("day", now(), TimeGenerated)
| where LastSignin > 60