Using Microsoft Sentinel and KQL to query authentication methods used by accounts.

By User or All Users

UserPrincipalName Authentication Methods Used
john.smith@domain.com [“Password”,”Mobile app notification”]
chris.dymond@domain.com [“Windows Hello for Business”]