Query Help on Filter for Login Locations

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

2. Describe your environment:

  • OS Information:

  • Package Version:

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

I am trying to display results of users that have successfully logged into azure ad from mulitple Countries within the last 24 hours.

createdDateTime:[now-1d TO now] AND conditionalAccessStatus:success

Other fields our source_geo_country which is the country field.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

source_geo_country is your key to count your values, to for “card()” which means differnt values. group by your users.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.