Identity Visualize Distinct Inbound Guests
Query
//Visualize distinct inbound guests (guest accounts accessing your tenant) per month
//Data connector required for this query - Azure Active Directory - Signin Logs
SigninLogs
| where TimeGenerated > ago(365d)
| where UserType == "Guest"
| where ResultType == 0
//Find only inbound guests, i.e those guests accessing your tenant.
| summarize Count=dcountif(UserPrincipalName, AADTenantId != HomeTenantId and HomeTenantId != ResourceTenantId) by startofmonth(TimeGenerated)
| render columnchart with (title="Distinct guest accounts accessing your tenant per month")Explanation
This query is used to visualize the number of distinct guest accounts accessing your tenant per month. It requires the Azure Active Directory - Signin Logs data connector.
The query filters the signin logs for the past 365 days and selects only guest user accounts. It then further filters for successful sign-ins.
The query then summarizes the count of distinct guest accounts accessing your tenant per month and visualizes it using a column chart. The chart's title is "Distinct guest accounts accessing your tenant per month".
Details
Matt Zorich
Released: June 17, 2022
Tables
SigninLogs
Keywords
DevicesIntuneUserAzure Active DirectorySignin LogsTimeGeneratedUserTypeResultTypeUserPrincipalNameAADTenantIdHomeTenantIdResourceTenantIdCount
Operators
where>ago==summarizedcountifbystartofmonthrender