User Account Locked AAD
Query
SigninLogs
| where TimeGenerated > ago(4h)
| where ResultType == "50053"
| project UserDisplayNameExplanation
This query is looking at the SigninLogs table and filtering for logs that were generated within the last 4 hours. It then further filters for logs where the ResultType is "50053". Finally, it selects and displays the UserDisplayName from these logs.