Can't drill into Sign-ins by location

[Tom Reppen]

Hello,

I'm using the Sentinel preview and I have the Azure AD sign-in logs dashboard installed.  On the locations pane of that dashboard it shows a number of logins from China, but when I select to view that on the analytics pane it doesn't give me any details other than the number of logins.  Is there somewhere that i can drill into it to see which accounts are logging in from China?  I have MFA enabled via EMS and nothing is alerting in my Azure AD premium regarding risky logins so not sure why it would be saying there are logins from China.

[#2 · Accepted solution]

The key is to remove the "summarize" line from the query.  Hope that helps someone else down the road