Using Microsoft Sentinel and KQL to query successful sign-ins from Service Principals that have occurred outside of a specified country.
By Service Principal
| ServicePrincipalName | Count of Locations | List of Locations |
|---|---|---|
| Application1 | 1 | “[UK]” |
| Application2 | 2 | “[NZ,UK]” |