PuneethRaya

Thank you very much!! We need alerting mechanism whenever successful Login. Will this query helps to achieve this? if i create advanced hunting query.

Wonderful!!one more last request... Is it possible get in output which web URL successful authentication happened ?

DeviceNetworkEvents | where RemoteUrl has "user ID " | project Timestamp, ReportId, InitiatingProcessAccountUpn, RemoteUrl This helped me !!thank you !!

Is there any way to restrict post authentication user shouldn't perform any activity/block or at least sending an auto email to the that particular AD users?