Microsoft 365 Defender: IdentityLogonEvents Query to Detect Logon from Foreign Countries and IP Addresses

Question

Is it possible to write a query based on IdentityLogonEvents table to find Azure AD's sign-in or log-on attempts from a foreign country or IP address?

Thanks!

Answer 1

Yes, You can to write a query based on the IdentityLogonEvents table to find Azure AD's sign-in or log-on attempts from a foreign country or IP address.

You can use the Kusto Query Language (KQL) to query your data in Microsoft 365 Defender under Advanced hunting.

IdentityLogonEvents
| where Country != "United States" //replace with your country
| project TimeGenerated, AccountName, IpAddress, LocationDetails.CountryRegion