query Azure AD signins

Copper Contributor


I would like to have a query to export the first signin for each user per day.

i.e. i would like to know the first time this user signedin each day.


thank you for your support

2 Replies



| where TimeGenerated > startofday(ago(0d))
| summarize Count = count() , arg_min(TimeGenerated, *) by UserDisplayName
| order by Count desc, UserDisplayName asc


arg_min, will finds the first occurrence for you.  


Working :), thank you dear. Appreciated.