User List per Application

Question

Hello,

I am trying to generate "Users List Per Application".

I have not been able to successfully find the right query for this. I attempted to modify the out of the box query

// User count per Application
// Distinct count of users by application.
SigninLogs
| project UserDisplayName, Identity,UserPrincipalName, AppDisplayName, AppId, ResourceDisplayName
| summarize UserCount=dcount(UserPrincipalName) by AppDisplayName

Answer 1

Hi @Cory Coleman , I'm not sure what you're using this for but this solution may work for you: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/users-bulk-download

You can bulk download a list of users with the portal, so no need for any queries. If this isn't what you're looking for please let me know and I can give you a better solution.

If this answer helped you please mark it as "Verified" so other users may reference it.

Thank you,
James

Answer 2

Hello James and thanks for the response.

I am using Azure Sentinel. I would like to create a table that lists the users using a particular application.
Distinct list of users by application.

When I run the query below, it shows only the count of users whereas I need the actual list of users by username or display name for an application. I tried modifying the out-of-box query below to no avail. I keep getting close, but no ciger.
// User count per Application
// Distinct count of users by application.
SigninLogs
| project UserDisplayName, Identity,UserPrincipalName, AppDisplayName, AppId, ResourceDisplayName
| summarize UserCount=dcount(UserPrincipalName) by AppDisplayName

Answer 3

Would this work?

SigninLogs
| project UserDisplayName, Identity,UserPrincipalName, AppDisplayName, AppId, ResourceDisplayName
| summarize UserCount=dcount(UserPrincipalName), UserList=make_set(UserDisplayName) by AppDisplayName
| order by UserCount desc