@Azure/M365 Legends - How to query ACTIVE Azure AD Guest Users that has EMPLOYEE TYPE as "Something" using KQL in Azure Log Analytics? Thanks all

Question

@Log Analytics (Azure Monitoring)

@Azure/M365 Legends - How to query ACTIVE Azure AD Guest Users that has EMPLOYEE TYPE as "Something" using KQL in Azure Log Analytics? Thanks all.

I tried using the below but it doesn't bring up the accurate result.

SigninLogs
| search "Something"
| where UserType == "Guest"
| project UserDisplayName

score 0 · Answer 1 · answered Mar 09 '23 at 07:58

Followed Microsoft-Document and I have reproduced in my environment and got below results:

Firstly, I have tested below command to check if I am getting Logs or not:

SigninLogs
| where UserType contains "Guest"
|project  UserDisplayName

And I got logs as below:

enter image description here

Then I checked the attributes of SinginLogs using below command:

SigninLogs
| where UserType contains "Guest"

enter image description here

I have observed that in SigninLogs there is No Attribute Called EmployeeType And you can also Check Microsoft-Document to verify that.

So You cannot filter on Users based on employeetype in SinginLogs of Azure AD.

1 Answers1