Query Details

User Account Locked AAD

Query

SigninLogs 
| where TimeGenerated > ago(4h) 
| where ResultType == "50053"
| project UserDisplayName

Explanation

This query is looking at the SigninLogs table and filtering for logs that were generated within the last 4 hours. It then further filters for logs where the ResultType is "50053". Finally, it selects and displays the UserDisplayName from these logs.

Details

Rod Trent profile picture

Rod Trent

Released: June 30, 2020

Tables

SigninLogs

Keywords

SigninLogs,TimeGenerated,ResultType,UserDisplayName

Operators

|where>ago()=="50053"project

Actions