Nathan McNulty @nathanmcnulty.com · Feb 9 Now you can run queries! :) SigninLogs | extend AuthMethod = ['authenticationDetails'][0]['authenticationMethod'] | extend AuthMethodDetail = ['authenticationDetails'][0]['authenticationMethodDetail'] | extend MfaMethod = ['authenticationDetails'][1]['authenticationMethod']
1 likes 1 replies
?
Replies
| where ['authenticationDetails'][0]['succeeded'] == true and ['authenticationDetails'][1]['succeeded'] == true | where AuthMethod != "Previously satisfied" or MfaMethod != "Previously satisfied" | distinct userPrincipalName,tostring(AuthMethod),tostring(AuthMethodDetail),tostring(MfaMethod)