Query Details
Identity Visualize Passwordvs Passwordless
Query
//Visualize password vs passwordless signins per day
//Data connector required for this query - Azure Active Directory - Signin Logs
SigninLogs
| where TimeGenerated > ago (180d)
| mv-expand todynamic(AuthenticationDetails)
| project TimeGenerated, AuthenticationDetails
| extend AuthMethod = tostring(AuthenticationDetails.authenticationMethod)
| summarize
Passwordless=countif(AuthMethod in ("Windows Hello for Business", "Passwordless phone sign-in", "FIDO2 security key", "X.509 Certificate")),
Password=countif(AuthMethod == "Password")
by bin(TimeGenerated, 1d)
| render timechart with (title="Passwordless vs Password Authentication", ytitle="Count")Explanation
This query visualizes the number of passwordless sign-ins versus password sign-ins per day. It uses the Azure Active Directory - Signin Logs data connector. The query filters the data for the past 180 days, expands the AuthenticationDetails field, and projects the TimeGenerated and AuthenticationDetails fields. It then extends the AuthMethod field to convert it to a string and counts the occurrences of passwordless and password authentication methods. Finally, it groups the results by day and renders a timechart with the title "Passwordless vs Password Authentication" and the y-axis labeled "Count".
Details
Matt Zorich
Released: June 17, 2022
Tables
SigninLogs
Keywords
SigninLogs,TimeGenerated,AuthenticationDetails,AuthMethod,Passwordless,Password
Operators
wheremv-expandprojectextendsummarizecountifinbybinrender