// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Sign-ins to your tenant by identities homed in the supplier's Entra tenant.
let SupplierTenantId = "REPLACE_WITH_SUPPLIER_TENANT_ID";
let WindowStart = datetime(2026-01-01T00:00:00Z);  // REPLACE: exposure start, UTC
union withsource=LogTable SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated between (WindowStart .. now())
| where HomeTenantId =~ SupplierTenantId
| project TimeGenerated, LogTable, UserPrincipalName, UserId, CrossTenantAccessType,
    HomeTenantId, ResourceTenantId, IPAddress, AppDisplayName, ResourceDisplayName,
    ResultType, ConditionalAccessStatus, CorrelationId
| order by TimeGenerated asc
| take 500