Using Microsoft Sentinel and KQL to query successful sign-ins from Service Principals that have occurred outside of a specified country.

By Service Principal

ServicePrincipalName Count of Locations List of Locations
Application1 1 “[UK]”
Application2 2 “[NZ,UK]”