let EndTime = now();
let StartTime = EndTime - 7d;
let AdminUPNs = dynamic(["REPLACE_WITH_ADMIN_UPN"]);
let TargetAppId = "REPLACE_WITH_APPLICATION_ID";
SigninLogs
| where TimeGenerated between (StartTime .. EndTime)
| where UserPrincipalName in~ (AdminUPNs)
| where AppId == TargetAppId
| where ResultType == "0"
| project TimeGenerated, UserPrincipalName, AppDisplayName, AppId,
    IPAddress, UserAgent, AuthenticationRequirement,
    ConditionalAccessStatus, CorrelationId
| order by TimeGenerated desc
| take 200