Using Microsoft Sentinel and KQL to query successful sign-ins from Service Principals that have occurred outside of a specified country.
By Service Principal
ServicePrincipalName | Count of Locations | List of Locations |
---|---|---|
Application1 | 1 | “[UK]” |
Application2 | 2 | “[NZ,UK]” |