Get account name if UserPrincipalName is UserId
Sometimes the signin events in the various AAD signin logs contain the UserId as the UserPrincipalName. In some spot checks it looks to me that this often happens when the signin comes from a Teams app on an iOS device…
This requires the reader of the output to lookup the UserId e.g. in the Entra ID portal, to figure out which user this was.
Is there a way to do this dynamically in the KQL query so that I could add the name to the output?
Sometimes the signin events in the various AAD signin logs contain the UserId as the UserPrincipalName. In some spot checks it looks to me that this often happens when the signin comes from a Teams app on an iOS device…This requires the reader of the output to lookup the UserId e.g. in the Entra ID portal, to figure out which user this was.Is there a way to do this dynamically in the KQL query so that I could add the name to the output? Read More