Queries for the AADManagedIdentitySignInLogs table

Most active managed identities

Gets list of top 100 most active managed identities for the last day.

AADManagedIdentitySignInLogs
| where TimeGenerated > ago(1d)
| summarize CountPerManagedIdentity = count() by ServicePrincipalId
| order by CountPerManagedIdentity desc
| take 100