Last Password Change Time with Account Creation Time

| where Department contains @"Cyber" or JobTitle contains "architect" //Example of further filtering

Detection Query

AADSignInEventsBeta
| join kind=leftouter IdentityInfo on AccountUpn 
//| where Department contains @"Cyber" or JobTitle contains "architect" //Example of further filtering
| summarize arg_max(LastPasswordChangeTimestamp,*) by AccountUpn, CreatedDateTime //Maximize last password change time
| project AccountUpn, CreatedDateTime, LastPasswordChangeTimestamp

Tags