// Utilisateurs authentifiés dans Azure AD mais que le "Device" ne se retrouve pas dans Intune
// Michel Caron
// Michel Caron
SigninLogs
| where ClientAppUsed contains "Browser"
| extend String=tostring(DeviceDetail)
| extend DeviceName=extractjson("$displayName", String)
| where DeviceName != ""
| join kind=leftanti IntuneDevices on $left.DeviceName == $right.DeviceName
| distinct Location,DeviceName,UserDisplayName,UserPrincipalName
| order by Location,DeviceName
| where ClientAppUsed contains "Browser"
| extend String=tostring(DeviceDetail)
| extend DeviceName=extractjson("$displayName", String)
| where DeviceName != ""
| join kind=leftanti IntuneDevices on $left.DeviceName == $right.DeviceName
| distinct Location,DeviceName,UserDisplayName,UserPrincipalName
| order by Location,DeviceName
