Querry returns 2 events instead of one

Question

I created a querry in sentinel for unfamiliar sign in. the logic app flow works well but the issue is this query sometimes returns 2 or more different events at the same time under the same incident number instead of one. And other times it will return one event like it should. how can i fix it to always return just one event per incident? here is the query.

Thank you all for your help

// The query_now parameter represents the time (in UTC) at which the scheduled analytics rule ran to produce this alert.
set query_now = datetime(2024-08-27T17:02:59.2030482Z);
let signin=
    SigninLogs 
    | where TimeGenerated > ago (24h)
    | extend SigninTime = TimeGenerated
    | where UserPrincipalName =~ UserPrincipalName
    | where RiskEventTypes_V2 != "[]"
    | summarize
        FirstSeen = min(TimeGenerated),
        LastObserved = max(TimeGenerated),
        SuccessfullCount = count(ResultType = 0),
        FailureCount = count(ResultType != 0) 
        by
        UserPrincipalName,
        IPAddress,
        Location,
        UserAgent,
        ClientAppUsed,
        AppDisplayName,
        RiskEventTypes_V2;
AADUserRiskEvents
| where TimeGenerated > ago(24h)
| extend RiskTime = TimeGenerated
| where DetectionTimingType == "realtime"
| join kind=inner SigninLogs on CorrelationId
| project UserDisplayName1, IpAddress, AppDisplayName, UserAgent, Location, RiskEventType