【Azure】サインインログのクエリメモ

①サインイン履歴（サインイン成功）
SigninLogs | where ResultType == 0 and (UserPrincipalName == “[e-mail]” or UserPrincipalName == “[e-mail]”)

②サインイン履歴（サインイン失敗）
SigninLogs | where ResultType != 0 and (UserPrincipalName == “[e-mail]” or UserPrincipalName == “[e-mail]”)

③更新履歴
AuditLogs | where OperationName == “Update user” and (TargetResources[0].userPrincipalName in (“admin1@ TENANTNAME.onmicrosoft.com”) or TargetResources[0].userPrincipalName in (“admin2@ TENANTNAME.onmicrosoft.com”)) | project TimeGenerated, InitiatedBy.user.userPrincipalName, TargetResources[0].userPrincipalName, TargetResources[0].modifiedProperties