KQL Search

Query Details

Users Affected By MFA Enforcement

Query

AADSignInEventsBeta
| where AuthenticationRequirement contains "singleFactor"
| where Application contains "Azure CLI" or Application contains "Azure Powershell"
| summarize by AccountDisplayName, Application,AccountUpn, OSPlatform, AuthenticationRequirement, ClientAppUsed

Explanation

This query looks at sign-in events in Azure Active Directory where the authentication requirement is single-factor and the application used is either Azure CLI or Azure Powershell. It then summarizes the data by account display name, application, account UPN, OS platform, authentication requirement, and client app used.