Expired Password
Query
SigninLogs
| where ResultType == "50055"
| project UserDisplayName, UserPrincipalNameExplanation
This query retrieves the SigninLogs where the ResultType is equal to "50055" and projects the UserDisplayName and UserPrincipalName.