// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Requires BOTH user sign-in tables. Replace the Entra object ID.
let TargetUserId = "REPLACE_WITH_ENTRA_USER_OBJECT_ID";
union withsource=LogTable SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated between (ago(24h) .. now())
| where UserId =~ TargetUserId
| project TimeGenerated, CreatedDateTime, LogTable, UserId, UserPrincipalName,
    IPAddress, AppDisplayName, AppId, ResourceDisplayName, ResultType,
    ResultDescription, ConditionalAccessStatus, CorrelationId
| order by TimeGenerated asc
| take 500