I know there was similar post 4 years ago, however, I am curious if anyone else has found a better way to query for this? I also know that EntraID has this information, but I don’t see it send this information to IDR. I feel like this would be good information for the UEBA part of IDR and for general auditing.
In our environment I do find Entra authentication logs under “Ingress Authentication” log sources. If you manage to find them I played around with this query in “Log” search and found no matter what timeframe I requested it only returned the very latest login event. The key value pair here might not be ideal but maybe it’s a starting point:
where("account" = someone@someplace.com AND "source_json.category" != "NonInteractiveUserSignInLogs") LIMIT(1)
Cw.