Query Details
Identity Visualize Guest App Access
Query
//Visualize the most popular enterprise applications accessed by guest accounts
//Data connector required for this query - Azure Active Directory - Signin Logs
let timeframe=45d;
SigninLogs
| where TimeGenerated > ago(timeframe)
| where UserType == "Guest" or UserPrincipalName contains "#ext#"
| where ResultType == 0
// Exclude Microsoft management applications
| where AppDisplayName !in ("Microsoft Invitation Acceptance Portal", "My Apps", "Microsoft App Access Panel", "Microsoft Authentication Broker")
| summarize AppCount=count()by AppDisplayName
| sort by AppCount desc
| render piechart with (title="Most Popular Apps Accessed by Guests")Explanation
This query visualizes the most popular enterprise applications accessed by guest accounts. It uses the Azure Active Directory - Signin Logs data connector. The query filters the logs for a specified timeframe and selects only guest accounts. It excludes certain Microsoft management applications. It then summarizes the count of each application accessed by guests and sorts them in descending order. Finally, it renders a pie chart to display the most popular apps accessed by guests.
Details
Matt Zorich
Released: June 17, 2022
Tables
SigninLogs
Keywords
Enterprise,Applications,Guest,Accounts,Data,Connector,Azure,Active,Directory,Signin,Logs,Timeframe,UserType,UserPrincipalName,ResultType,AppDisplayName,AppCount,Sort,Render,Piechart
Operators
where|>ago==orcontains!insummarizecountbysortdescrender