Retrieve AzureAD Users sign-in logs Kusto Resource Graph Query

Question

I am trying to get a list of users logged into azure AD, that can be seen under Users | All Users from the azure portal, using Kusto Resource Graph Query but does anybody know how to call this? i understand i can List all sign-ins via http response

GET https://graph.microsoft.com/v1.0/auditLogs/signIns

but how do i call this in Resource Graph?

I know i can call resources to Show a List resources sorted by name

e.g

Resources
| project name, type, location
| order by name asc

and can call

resources
| where identity contains "userAssignedIdentities"

but all im returning is user assigned identities.. and not Users i.e User Type, User Principle Name, Name, Account Enabled, Company etc

that should be specific to All Users and Signin-Logs

any help would be appreciated

many thanks

Answer 1

You can pull the signin logs of users using kusto query -- for that you need to few prerequisite

1. You should have Secuirity admin or global admin Permission.

2. Creating a log analytics workspace.

3. Setting diagnostic settings.

You can follow this Microsoft Document to create log analytics workspace and add in ActiveDirectory->Diagnotics Setting.

You can use the below Kusto Query in AzureActiveDirectory->Log Analytics

SigninLogs
| project UserId,UserType,UserDisplayName

Note : There is not option to project AccountEnable,Company