← Back to Explore
kqlHunting
Entra Sign-ins to Legacy Azure Active Directory Powershell
Detection Query
SigninLogs
| where TimeGenerated > ago(90d)
| where AppDisplayName == "Azure Active Directory PowerShell"
| summarize count() by UserPrincipalNameData Sources
SigninLogs
Platforms
azure-ad
Tags
entra
Raw Content
SigninLogs
| where TimeGenerated > ago(90d)
| where AppDisplayName == "Azure Active Directory PowerShell"
| summarize count() by UserPrincipalName