Microsoft 365 Defender: IdentityLogonEvents Query to Detect Logon from Foreign Countries and IP Addresses

Khoa Tran 40 Reputation points
2023-07-14T14:17:16.6966667+00:00

Is it possible to write a query based on IdentityLogonEvents table to find Azure AD's sign-in or log-on attempts from a foreign country or IP address?

Thanks!

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Catherine Kyalo 655 Reputation points Microsoft Employee
    2024-03-15T11:52:48.6566667+00:00

    Yes, You can to write a query based on the IdentityLogonEvents table to find Azure AD's sign-in or log-on attempts from a foreign country or IP address.

    You can use the Kusto Query Language (KQL) to query your data in Microsoft 365 Defender under Advanced hunting. 

    IdentityLogonEvents
| where Country != "United States" //replace with your country
| project TimeGenerated, AccountName, IpAddress, LocationDetails.CountryRegion
    0 comments