Query Details
Entra Sign Ins To Legacy Azure Active Directory Powershell
Query
SigninLogs | where TimeGenerated > ago(90d) | where AppDisplayName == "Azure Active Directory PowerShell" | summarize count() by UserPrincipalName
Explanation
This query is analyzing sign-in logs to count how many times each user has logged into the "Azure Active Directory PowerShell" application over the past 90 days. It filters the logs to only include entries from the last 90 days and then groups the results by each user's principal name, providing a count of sign-ins for each user.
Details
Jay Kerai
Released: July 3, 2025
Tables
SigninLogs
Keywords
SigninLogsUser
Operators
SigninLogs|where>ago()d==summarizecount()by