r/Defender•
Kuro507

KQL to report all devices a user has logged in from

Currently we do not restrict which devices employees can use to access our M365 systems (don't even ask...).

Can I produce a list with KQL to show all devices a user has authenticated from? (Picking one individual Entra user account)

Furthermore can I then report on which Teams sites, calls and SharePoint/Onedrive they may have used from each device? or even full report every Office activity on each device?

Posted Jul 16, 2024, 9:58 PM UTC

32
Loading comments…