Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for ConditionalAccessPolicies

Submit an example for AuthenticationProcessingDetails

Submit an example for NetworkLocationDetails

Submit an example for RiskEventTypes

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Logon type Conditional access status

`AuthenticationProcessingDetails`

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "EXAMPLE_LABEL_001",
    "value": "VALUE_2"
  },
  {
    "key": "EXAMPLE_LABEL_002",
    "value": "VALUE_3"
  },
  {
    "key": "EXAMPLE_LABEL_003",
    "value": "VALUE_3"
  },
  {
    "key": "EXAMPLE_LABEL_004",
    "value": "VALUE_3"
  },
  {
    "key": "EXAMPLE_LABEL_005",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=EXAMPLE_LABEL_001]`	named-property
`$[][key=EXAMPLE_LABEL_002]`	named-property
`$[][key=EXAMPLE_LABEL_003]`	named-property
`$[][key=EXAMPLE_LABEL_004]`	named-property
`$[][key=EXAMPLE_LABEL_005]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  },
  {
    "key": "Oauth Scope Info",
    "value": "[\"VALUE_2\"]"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	encoded-json
`$[].value`	string
`$[].value::<json>`	array
`$[].value::<json>[]`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Oauth Scope Info]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_2"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_2"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_2"
  },
  {
    "key": "Login Hint Present",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Login Hint Present]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies failed (1)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  },
  {
    "key": "Root Key Type",
    "value": "VALUE_3"
  },
  {
    "key": "Token Binding Attempted",
    "value": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Root Key Type]`	named-property
`$[][key=Token Binding Attempted]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_2"
  },
  {
    "key": "Is Client Capable",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_2"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_2"
  },
  {
    "key": "Oauth Scope Info",
    "value": "[\"VALUE_3\"]"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	encoded-json
`$[].value`	string
`$[].value::<json>`	array
`$[].value::<json>[]`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Client Capable]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Oauth Scope Info]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "EXAMPLE_LABEL_001",
    "value": "VALUE_1"
  },
  {
    "key": "Is CAE Token",
    "value": "VALUE_2"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_2"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=EXAMPLE_LABEL_001]`	named-property
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "EXAMPLE_LABEL_001",
    "value": "VALUE_1"
  },
  {
    "key": "Is CAE Token",
    "value": "VALUE_2"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_2"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_2"
  },
  {
    "key": "Oauth Scope Info",
    "value": "[\"VALUE_3\"]"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	encoded-json
`$[].value`	string
`$[].value::<json>`	array
`$[].value::<json>[]`	string
`$[][key=EXAMPLE_LABEL_001]`	named-property
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Oauth Scope Info]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "EXAMPLE_LABEL_001",
    "value": "VALUE_2"
  },
  {
    "key": "Is CAE Token",
    "value": "VALUE_3"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_3"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_3"
  },
  {
    "key": "Login Hint Present",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=EXAMPLE_LABEL_001]`	named-property
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Login Hint Present]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  },
  {
    "key": "Oauth Scope Info",
    "value": "[\"VALUE_2\"]"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	encoded-json
`$[].value`	string
`$[].value::<json>`	array
`$[].value::<json>[]`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Oauth Scope Info]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  },
  {
    "key": "Root Key Type",
    "value": "VALUE_3"
  },
  {
    "key": "Token Binding Attempted",
    "value": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Root Key Type]`	named-property
`$[][key=Token Binding Attempted]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_2"
  },
  {
    "key": "Is Client Capable",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_2"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_2"
  },
  {
    "key": "Oauth Scope Info",
    "value": "[\"VALUE_3\"]"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	encoded-json
`$[].value`	string
`$[].value::<json>`	array
`$[].value::<json>[]`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Client Capable]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property
`$[][key=Oauth Scope Info]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Is CAE Token",
    "value": "VALUE_1"
  },
  {
    "key": "Is Legacy Store Used",
    "value": "VALUE_1"
  },
  {
    "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Is CAE Token]`	named-property
`$[][key=Is Legacy Store Used]`	named-property
`$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

`ConditionalAccessPolicies`

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "enforcedSessionControls": [
      "VALUE_5"
    ],
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_7"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000011",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_8"
      }
    ],
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_3"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_45",
    "enforcedSessionControls": [
      "VALUE_5"
    ],
    "id": "00000000-0000-4000-8000-000000000049",
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000012",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_8"
      }
    ],
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000028",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_27",
    "id": "00000000-0000-4000-8000-000000000029",
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000039",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_5"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_10"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000039",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_12"
    ],
    "id": "00000000-0000-4000-8000-000000000082",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_8"
      }
    ],
    "result": "VALUE_19"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_15",
    "enforcedGrantControls": [
      "VALUE_11"
    ],
    "id": "00000000-0000-4000-8000-000000000016",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_8"
      }
    ],
    "result": "VALUE_10"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_20",
    "enforcedGrantControls": [
      "VALUE_13"
    ],
    "enforcedSessionControls": [
      "VALUE_5"
    ],
    "id": "00000000-0000-4000-8000-000000000021",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_8"
      }
    ],
    "result": "VALUE_10"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_29",
    "enforcedGrantControls": [
      "VALUE_12"
    ],
    "id": "00000000-0000-4000-8000-000000000031",
    "result": "VALUE_10"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_4"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_46",
    "enforcedSessionControls": [
      "VALUE_16"
    ],
    "id": "00000000-0000-4000-8000-000000000050",
    "result": "VALUE_10"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_57",
    "enforcedSessionControls": [
      "VALUE_16"
    ],
    "id": "00000000-0000-4000-8000-000000000061",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_10"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies failed (1)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_4"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_46",
    "enforcedSessionControls": [
      "VALUE_10"
    ],
    "id": "00000000-0000-4000-8000-000000000050",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_49",
    "id": "00000000-0000-4000-8000-000000000053",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_59",
    "enforcedSessionControls": [
      "VALUE_10"
    ],
    "id": "00000000-0000-4000-8000-000000000063",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "id": "00000000-0000-4000-8000-000000000012",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "enforcedSessionControls": [
      "VALUE_10"
    ],
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_18"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_16",
    "enforcedGrantControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000017",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_20",
    "enforcedGrantControls": [
      "VALUE_7"
    ],
    "enforcedSessionControls": [
      "VALUE_10"
    ],
    "id": "00000000-0000-4000-8000-000000000021",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_5"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_36",
    "enforcedGrantControls": [
      "VALUE_14"
    ],
    "id": "00000000-0000-4000-8000-000000000039",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_66",
    "enforcedSessionControls": [
      "VALUE_16"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_69",
    "enforcedSessionControls": [
      "VALUE_10"
    ],
    "id": "00000000-0000-4000-8000-000000000073",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_14",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_9"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000015",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_5"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_3"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_45",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000049",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000013",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_13",
    "id": "00000000-0000-4000-8000-000000000014",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_5"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000028",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_27",
    "id": "00000000-0000-4000-8000-000000000029",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000039",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_6"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000039",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_12"
    ],
    "id": "00000000-0000-4000-8000-000000000082",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_5"
      }
    ],
    "result": "VALUE_19"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_17",
    "enforcedGrantControls": [
      "VALUE_11"
    ],
    "id": "00000000-0000-4000-8000-000000000018",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_5"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_19",
    "enforcedGrantControls": [
      "VALUE_13"
    ],
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000020",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_5"
      }
    ],
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_29",
    "enforcedGrantControls": [
      "VALUE_12"
    ],
    "id": "00000000-0000-4000-8000-000000000031",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_4"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_46",
    "enforcedSessionControls": [
      "VALUE_16"
    ],
    "id": "00000000-0000-4000-8000-000000000050",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_57",
    "enforcedSessionControls": [
      "VALUE_16"
    ],
    "id": "00000000-0000-4000-8000-000000000061",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_1"
      }
    ],
    "result": "VALUE_6"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_10",
    "id": "00000000-0000-4000-8000-000000000011",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_6",
    "enforcedGrantControls": [
      "VALUE_5"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_17"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_9",
    "id": "00000000-0000-4000-8000-000000000010",
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000036",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_45",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000050",
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000036",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_58",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_13"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000063",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "result": "VALUE_1"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_14",
    "enforcedGrantControls": [
      "VALUE_4"
    ],
    "id": "00000000-0000-4000-8000-000000000015",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_18",
    "enforcedGrantControls": [
      "VALUE_4"
    ],
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000019",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "enforcedGrantControls": [
      "VALUE_11"
    ],
    "id": "00000000-0000-4000-8000-000000000039",
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_65",
    "enforcedSessionControls": [
      "VALUE_15"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_68",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000073",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_5"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "id": "00000000-0000-4000-8000-000000000038",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_49",
    "id": "00000000-0000-4000-8000-000000000053",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "id": "00000000-0000-4000-8000-000000000012",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_9"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_17"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_16",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000017",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_19",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000020",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_37",
    "enforcedGrantControls": [
      "VALUE_13"
    ],
    "id": "00000000-0000-4000-8000-000000000040",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_66",
    "enforcedSessionControls": [
      "VALUE_15"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_69",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000073",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_5"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "id": "00000000-0000-4000-8000-000000000038",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_49",
    "id": "00000000-0000-4000-8000-000000000053",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_58",
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_16"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000062",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_17"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "id": "00000000-0000-4000-8000-000000000012",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_9"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_20"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_16",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000017",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_19",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000020",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_56",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000060",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_66",
    "enforcedSessionControls": [
      "VALUE_18"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_17"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_67",
    "enforcedSessionControls": [
      "VALUE_18"
    ],
    "id": "00000000-0000-4000-8000-000000000071",
    "result": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_10",
    "id": "00000000-0000-4000-8000-000000000011",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_6",
    "enforcedGrantControls": [
      "VALUE_5"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_17"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000009",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_9",
    "id": "00000000-0000-4000-8000-000000000010",
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000036",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_45",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000050",
    "result": "VALUE_2"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000036",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_58",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_13"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000063",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "result": "VALUE_1"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_14",
    "enforcedGrantControls": [
      "VALUE_4"
    ],
    "id": "00000000-0000-4000-8000-000000000015",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_17",
    "enforcedGrantControls": [
      "VALUE_4"
    ],
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000018",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "enforcedGrantControls": [
      "VALUE_11"
    ],
    "id": "00000000-0000-4000-8000-000000000039",
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_65",
    "enforcedSessionControls": [
      "VALUE_15"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "result": "VALUE_2"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_68",
    "enforcedSessionControls": [
      "VALUE_7"
    ],
    "id": "00000000-0000-4000-8000-000000000073",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[]

Payload fields and types

Path	Type
`$`	array

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[]

Payload fields and types

Path	Type
`$`	array

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_5"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "id": "00000000-0000-4000-8000-000000000038",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_50",
    "id": "00000000-0000-4000-8000-000000000054",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "id": "00000000-0000-4000-8000-000000000012",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_9"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_17"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_16",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000017",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_20",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000021",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_37",
    "enforcedGrantControls": [
      "VALUE_13"
    ],
    "id": "00000000-0000-4000-8000-000000000040",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_66",
    "enforcedSessionControls": [
      "VALUE_15"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_69",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000073",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_2",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000002",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_5"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_35",
    "id": "00000000-0000-4000-8000-000000000038",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_47",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000051",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_49",
    "id": "00000000-0000-4000-8000-000000000053",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000001",
      "authenticationStrengthResult": 1,
      "displayName": "USERNAME_1"
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_58",
    "excludeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_16"
      }
    ],
    "id": "00000000-0000-4000-8000-000000000062",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_17"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_11",
    "id": "00000000-0000-4000-8000-000000000012",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_12",
    "id": "00000000-0000-4000-8000-000000000013",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_48",
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000052",
    "result": "VALUE_7"
  },
  {
    "authenticationStrength": {
      "authenticationStrengthId": "00000000-0000-4000-8000-000000000011",
      "authenticationStrengthResult": 1
    },
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_8",
    "enforcedGrantControls": [
      "VALUE_9"
    ],
    "id": "00000000-0000-4000-8000-000000000081",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_20"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_16",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000017",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_19",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "enforcedSessionControls": [
      "VALUE_1"
    ],
    "id": "00000000-0000-4000-8000-000000000020",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_3"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_3",
    "id": "00000000-0000-4000-8000-000000000003",
    "result": "VALUE_6"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_56",
    "enforcedGrantControls": [
      "VALUE_8"
    ],
    "id": "00000000-0000-4000-8000-000000000060",
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_66",
    "enforcedSessionControls": [
      "VALUE_18"
    ],
    "id": "00000000-0000-4000-8000-000000000070",
    "includeRulesSatisfied": [
      {
        "conditionalAccessCondition": 1,
        "ruleSatisfied": "VALUE_17"
      }
    ],
    "result": "VALUE_7"
  },
  {
    "conditionsNotSatisfied": 1,
    "conditionsSatisfied": 1,
    "displayName": "USERNAME_67",
    "enforcedSessionControls": [
      "VALUE_18"
    ],
    "id": "00000000-0000-4000-8000-000000000071",
    "result": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].authenticationStrength`	object
`$[].authenticationStrength.authenticationStrengthId`	string
`$[].authenticationStrength.authenticationStrengthResult`	integer
`$[].authenticationStrength.displayName`	string
`$[].conditionsNotSatisfied`	integer
`$[].conditionsSatisfied`	integer
`$[].displayName`	string
`$[].enforcedGrantControls`	array
`$[].enforcedGrantControls[]`	string
`$[].enforcedSessionControls`	array
`$[].enforcedSessionControls[]`	string
`$[].excludeRulesSatisfied`	array
`$[].excludeRulesSatisfied[]`	object
`$[].excludeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].excludeRulesSatisfied[].ruleSatisfied`	string
`$[].id`	string
`$[].includeRulesSatisfied`	array
`$[].includeRulesSatisfied[]`	object
`$[].includeRulesSatisfied[].conditionalAccessCondition`	integer
`$[].includeRulesSatisfied[].ruleSatisfied`	string
`$[].result`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

`NetworkLocationDetails`

Logon type: Non-interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "networkNames": [
      "VALUE_1"
    ],
    "networkType": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].networkNames`	array
`$[].networkNames[]`	string
`$[].networkType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "networkNames": [
      "VALUE_1"
    ],
    "networkType": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].networkNames`	array
`$[].networkNames[]`	string
`$[].networkType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[]

Payload fields and types

Path	Type
`$`	array

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies failed (1)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "networkNames": [
      "VALUE_1"
    ],
    "networkType": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].networkNames`	array
`$[].networkNames[]`	string
`$[].networkType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Non-interactive user · Conditional access status: Policies not applied (2)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "networkNames": [
      "VALUE_1"
    ],
    "networkType": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].networkNames`	array
`$[].networkNames[]`	string
`$[].networkType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Logon type: Interactive user · Conditional access status: Policies applied (0)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "networkNames": [
      "VALUE_1"
    ],
    "networkType": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].networkNames`	array
`$[].networkNames[]`	string
`$[].networkType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntraIdSignInEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Information about Microsoft Entra ID sign-in events either by a user (interactive) or a client on the user’s behalf (non-interactive)	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountUpn	User principal name (UPN) of the account	String
AlternateSignInName	On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	String
AuthenticationProcessingDetails	Details about the authentication processor	String
AuthenticationRequirement	Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).	String
Browser	Details about the version of the browser used to sign in	String
City	City where the client IP address is geolocated	String
ClientAppUsed	Indicates the client app used	String
ConditionalAccessPolicies	Details of the conditional access policies applied to the sign-in event	String
ConditionalAccessStatus	Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).	Int32
CorrelationId	Unique identifier of the sign-in event	String
Country	Country/Region where the account user is located	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
DeviceTrustType	Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.	String
EndpointCall	Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in	String
EntraIdDeviceId	Unique identifier for the device in Microsoft Entra ID	String
ErrorCode	Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes	Int32
GatewayJA4	The JA4 fingerprint is a hash derived from the TLS Client Hello request. This JA4 fingerprint serves as a unique identifier for the client’s TLS configuration.	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
IsCompliant	Indicates whether the device that initiated the event is compliant or not	Int32
IsExternalUser	Indicates whether a user inside the network does not belong to the organization’s domain	Int32
IsGuestUser	Indicates whether the user that signed in is a guest in the tenant	Boolean
IsManaged	Indicates if the device is managed by the organization (True) or not (False)	Int32
IsSignInThroughGlobalSecureAccess	Indicates whether the sign-in event came through Global Secure Access.	Boolean
LastPasswordChangeTimestamp	Date and time when the user that signed in last changed their password	DateTime
Latitude	The north to south coordinates of the sign-in location	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
Longitude	The east to west coordinates of the sign-in location	String
NetworkLocationDetails	Network location details of the authentication processor of the sign-in event	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
ReportId	Unique identifier for the event	String
RequestId	Unique identifier of the request	String
ResourceDisplayName	Display name of the resource accessed. The display name can contain any character.	String
ResourceId	Unique identifier of the resource accessed	String
ResourceTenantId	Unique identifier of the tenant of the resource accessed	String
RiskEventTypes	Array of risk event types applicable to the event	String
RiskLevelAggregated	Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).	Int32
RiskLevelDuringSignIn	User risk level at sign-in	Int32
RiskState	Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).	Int32
SessionId	Unique number assigned to a user by a website’s server for the duration of the visit or session	String
SourceSystem		String
State	State where the sign-in occurred, if available	String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
TokenIssuerType	Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)	String
Type		String
UniqueTokenId	A unique identifier for the token passed during sign-in. This identifier is used to correlate the sign-in with the token request.	String
UserAgent	User agent information from the web browser or other client application	String

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-02-10	Column UniqueTokenId added
2026-02-10	Column IsSignInThroughGlobalSecureAccess added
2026-01-02	Table added to tracking

Other notes

As Invictus IR noted in their post about these logs, SignInActivityId differs between sign-in logs and activity logs. Padding (==) is not the only difference: in my Sentinel data, about 55% of the IDs use GUID format, and I haven’t found this format in any other connected log source.

This query counts the unique IDs in AADGraphActivityLogs from the last 90 days and shows how many are padded or GUID-shaped:

AADGraphActivityLogs
| where TimeGenerated > ago(90d)
| summarize by SignInActivityId
| summarize
    Padded=countif(SignInActivityId endswith "=="),
    GUID=countif(SignInActivityId matches regex @"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
    TotalUnique=dcount(SignInActivityId)

EntraIdSignInEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Information about Microsoft Entra ID sign-in events either by a user (interactive) or a client on the user’s behalf (non-interactive)	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountUpn	User principal name (UPN) of the account	String
AlternateSignInName	On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	String
AuthenticationProcessingDetails	Details about the authentication processor	String
AuthenticationRequirement	Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).	String
Browser	Details about the version of the browser used to sign in	String
City	City where the client IP address is geolocated	String
ClientAppUsed	Indicates the client app used	String
ConditionalAccessPolicies	Details of the conditional access policies applied to the sign-in event	String
ConditionalAccessStatus	Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).	Int32
CorrelationId	Unique identifier of the sign-in event	String
Country	Country/Region where the account user is located	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
DeviceTrustType	Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.	String
EndpointCall	Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in	String
EntraIdDeviceId	Unique identifier for the device in Microsoft Entra ID	String
ErrorCode	Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes	Int32
GatewayJA4	The JA4 fingerprint is a hash derived from the TLS Client Hello request. This JA4 fingerprint serves as a unique identifier for the client’s TLS configuration.	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
IsCompliant	Indicates whether the device that initiated the event is compliant or not	Int32
IsExternalUser	Indicates whether a user inside the network does not belong to the organization’s domain	Int32
IsGuestUser	Indicates whether the user that signed in is a guest in the tenant	Boolean
IsManaged	Indicates if the device is managed by the organization (True) or not (False)	Int32
IsSignInThroughGlobalSecureAccess	Indicates whether the sign-in event came through Global Secure Access.	Boolean
LastPasswordChangeTimestamp	Date and time when the user that signed in last changed their password	DateTime
Latitude	The north to south coordinates of the sign-in location	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
Longitude	The east to west coordinates of the sign-in location	String
NetworkLocationDetails	Network location details of the authentication processor of the sign-in event	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
ReportId	Unique identifier for the event	String
RequestId	Unique identifier of the request	String
ResourceDisplayName	Display name of the resource accessed. The display name can contain any character.	String
ResourceId	Unique identifier of the resource accessed	String
ResourceTenantId	Unique identifier of the tenant of the resource accessed	String
RiskEventTypes	Array of risk event types applicable to the event	String
RiskLevelAggregated	Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).	Int32
RiskLevelDuringSignIn	User risk level at sign-in	Int32
RiskState	Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).	Int32
SessionId	Unique number assigned to a user by a website’s server for the duration of the visit or session	String
SourceSystem		String
State	State where the sign-in occurred, if available	String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
TokenIssuerType	Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)	String
Type		String
UniqueTokenId	A unique identifier for the token passed during sign-in. This identifier is used to correlate the sign-in with the token request.	String
UserAgent	User agent information from the web browser or other client application	String

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-02-10	Column UniqueTokenId added
2026-02-10	Column IsSignInThroughGlobalSecureAccess added
2026-01-02	Table added to tracking

Other notes

This query counts the unique IDs in AADGraphActivityLogs from the last 90 days and shows how many are padded or GUID-shaped:

AADGraphActivityLogs
| where TimeGenerated > ago(90d)
| summarize by SignInActivityId
| summarize
    Padded=countif(SignInActivityId endswith "=="),
    GUID=countif(SignInActivityId matches regex @"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"),
    TotalUnique=dcount(SignInActivityId)