User Account Locked AAD
Query
SigninLogs
| where TimeGenerated > ago(4h)
| where ResultType == "50053"
| project UserDisplayNameExplanation
This query is looking at the SigninLogs table and filtering for logs that were generated within the last 4 hours. It then further filters for logs where the ResultType is "50053". Finally, it selects and displays the UserDisplayName from these logs.
Details
Rod Trent
Released: June 30, 2020
Tables
SigninLogs
Keywords
SigninLogsTimeGeneratedResultTypeUserDisplayName
Operators
|where>ago()=="50053"project