KQL Search

//Detects users who have accessed Azure AD Management interfaces, such as Azure AD PowerShell or Graph Explorer, who have not accessed in the previous timeframe. 

//Data connector required for this query - Azure Active Directory - Signin Logs

//Add additional applications to include them in the same query, i.e Defender for Cloud Apps portal.
//Select a time frame to look back on, i.e find users logging on for the first time today not seen in the prior 60 days
let timeframe = startofday(ago(60d));
let applications = dynamic(["Azure Active Directory PowerShell", "Microsoft Azure PowerShell", "Graph Explorer", "ACOM Azure Website", "Azure Portal", "Azure Advanced Threat Protection"]);
SigninLogs
| where TimeGenerated > timeframe and TimeGenerated < startofday(now())
| where AppDisplayName in (applications)
| project UserPrincipalName, AppDisplayName
| join kind=rightanti
    (
    SigninLogs
    | where TimeGenerated > startofday(now())
    | where AppDisplayName in (applications)
    )
    on UserPrincipalName, AppDisplayName
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, ResultType, AppDisplayName, IPAddress, Location, UserAgent