KQL SiginLogs

[gaudium91]

Hi Everyone, i ask you a question from basilar KQL " SigninLogs | Project Id,UserId,Identity" i receive correctly the events, but in some case in the Identity coloum receive an ID  in this format xxxx-xxxxx-xxxx and not the Disaplay Name ?

Why ?

Many Thanks,

Guido

[#2]

i add another, in some cases i find that Identity is the objectid of the users, infact i search id into entra ID the objectid correspond to users why appears ?

[#3 · Accepted solution]

@gaudium91 

Identity is the actor logging in which can be the GUID of an App 
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs

Check the AppDisplayName
e.g.

[#4]

Nice Clive, yes is there an app ID thank you for your asnwer.

Guido

[#5]

@gaudium91 usually this will happen when the sign-in activity is not completely succesful, look at the result type, just remember to summarize or filter by UserId if you want ALL activity to appear.