Share via

Queries for the AADManagedIdentitySignInLogs table

  • Article

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Most active managed identities

Gets list of top 100 most active managed identities for the last day.

AADManagedIdentitySignInLogs
| where TimeGenerated > ago(1d)
| summarize CountPerManagedIdentity = count() by ServicePrincipalId
| order by CountPerManagedIdentity desc
| take 100