Query Details
User Account Locked AAD
Query
SigninLogs | where TimeGenerated > ago(4h) | where ResultType == "50053" | project UserDisplayName
Explanation
This query is looking at the SigninLogs table and filtering for logs that were generated within the last 4 hours. It then further filters for logs where the ResultType is "50053". Finally, it selects and displays the UserDisplayName from these logs.
Details
Rod Trent
Released: June 30, 2020
Tables
SigninLogs
Keywords
SigninLogs,TimeGenerated,ResultType,UserDisplayName
Operators
|where>ago()=="50053"project