Using Microsoft Sentinel and KQL to query authentication methods used by accounts.
By User or All Users
UserPrincipalName | Authentication Methods Used |
---|---|
john.smith@domain.com | [“Password”,”Mobile app notification”] |
chris.dymond@domain.com | [“Windows Hello for Business”] |