// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
let TargetUserId = "REPLACE_WITH_ENTRA_USER_OBJECT_ID";
SigninLogs
| where TimeGenerated between (ago(24h) .. now())
| where UserId =~ TargetUserId
| project TimeGenerated, CreatedDateTime, UserId, UserPrincipalName,
    IPAddress, AppDisplayName, ResultType, ConditionalAccessStatus, DeviceDetail
| order by TimeGenerated asc
| take 500