Query Details
Users Affected By MFA Enforcement
Query
AADSignInEventsBeta | where AuthenticationRequirement contains "singleFactor" | where Application contains "Azure CLI" or Application contains "Azure Powershell" | summarize by AccountDisplayName, Application,AccountUpn, OSPlatform, AuthenticationRequirement, ClientAppUsed
Explanation
This query looks at sign-in events in Azure Active Directory where the authentication requirement is single-factor and the application used is either Azure CLI or Azure Powershell. It then summarizes the data by account display name, application, account UPN, OS platform, authentication requirement, and client app used.
Details
Sergio Albea
Released: June 7, 2024
Tables
AADSignInEventsBeta
Keywords
AADSignInEventsBeta,AuthenticationRequirement,Application,AccountDisplayName,AccountUpn,OSPlatform,ClientAppUsed
Operators
wherecontainsorsummarizeby