This query is designed to enhance the information available in the Microsoft Graph Activity Logs by adding application details from another data source, specifically the AAD Non-Interactive User Sign-In Logs. Here's a simple breakdown of what the query does:

1. Extract Application Information:

   • It first looks at the AAD Non-Interactive User Sign-In Logs from the past 30 days.
   • It identifies the most recent log entry for each application (using arg_max to get the latest entry based on TimeGenerated).
   • It then extracts and renames the application's display name to ApplicationName and ensures each application is listed only once (using distinct).

2. Enrich Activity Logs:

   • The query then takes the Microsoft Graph Activity Logs and attempts to match each log entry with the application information extracted earlier.
   • This is done using a lookup operation, which joins the logs with the application data based on a matching application ID (AppId in the activity logs and ResourceIdentity in the sign-in logs).

3. Reorder Columns:

   • Finally, it rearranges the columns to display the application ID and name prominently at the beginning of the results.

Limitation: The query only includes applications that have had user sign-ins, meaning if an application hasn't been used in the past 30 days, it won't appear in the enriched logs.

Alternative: There's a mention of an alternative query that uses the externaldata operator to overcome this limitation, which might be useful if you need to include applications without recent sign-ins.

This query is useful for gaining more context about the applications involved in the activities logged by Microsoft Graph, helping in better analysis and monitoring.