{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "\r\n\r\n# AAD Non-Interactive Sign-In Logs\r\n\r\n## 💡 Introduction\r\n\r\nThis workbook provides insights into non-interactive sign-ins collected from Azure AD. These events often involve service principals, managed identities, and background authentication.\r\n"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "c5b8deaf-4bc7-40e5-bfb0-5105468c73b3",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 604800000,
              "endTime": "2025-04-08T08:14:00.000Z"
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 3"
    },
    {
      "type": 1,
      "content": {
        "json": "## 🔍 Summary Tiles (Metrics)"
      },
      "name": "text - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\n| summarize Count = count()\n",
        "size": 4,
        "title": "Total Non-Interactive Sign-Ins",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "25",
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\n| summarize Count = dcount(AppDisplayName)\n",
        "size": 4,
        "title": "Unique Apps",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "25",
      "name": "query - 2 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\n| summarize Count = dcount(IPAddress)\n",
        "size": 4,
        "title": " Unique IPs",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "25",
      "name": "query - 2 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\n| where ResultType != 0 \n| summarize Count = count()\n",
        "size": 4,
        "title": "Failures",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "25",
      "name": "query - 2 - Copy - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## 📊 Top Applications by Non-Interactive Sign-Ins"
      },
      "name": "text - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend = (\r\nAADNonInteractiveUserSignInLogs\r\n| summarize SignInCount = count() by bin(TimeGenerated, {TimeRange:grain}), AppDisplayName\r\n| summarize Trend = makelist(SignInCount) by AppDisplayName \r\n);\r\nAADNonInteractiveUserSignInLogs\r\n| summarize SignInCount = count() by AppDisplayName \r\n| top 10 by SignInCount desc\r\n| join kind = inner\r\n(trend) on AppDisplayName\r\n| project-away AppDisplayName1 ",
        "size": 0,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "SignInCount",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "name": "query - 9"
    },
    {
      "type": 1,
      "content": {
        "json": "## 📈 Non-Interactive Sign-In Trends"
      },
      "name": "text - 10"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\r\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain})\r\n| render timechart ",
        "size": 0,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 11"
    },
    {
      "type": 1,
      "content": {
        "json": "## ❌ Failed Non-Interactive Sign-Ins"
      },
      "name": "text - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\r\n| where ResultType != 0 \r\n| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, ResultDescription\r\n| order by TimeGenerated desc",
        "size": 0,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 13"
    },
    {
      "type": 1,
      "content": {
        "json": "## 🌍 IP Geolocation Map"
      },
      "name": "text - 14"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\r\n| extend latitude_ = tostring(parse_json(tostring(parse_json(LocationDetails).geoCoordinates)).latitude)\r\n| extend longitude_ = tostring(parse_json(tostring(parse_json(LocationDetails).geoCoordinates)).longitude)\r\n| summarize count() by latitude_, longitude_",
        "size": 0,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "map",
        "mapSettings": {
          "locInfo": "LatLong",
          "locInfoColumn": "Location",
          "latitude": "latitude_",
          "longitude": "longitude_",
          "sizeSettings": "count_",
          "sizeAggregation": "Sum",
          "labelSettings": "latitude_",
          "legendMetric": "count_",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "nodeColorField": "count_",
            "colorAggregation": "Sum",
            "type": "heatmap",
            "heatmapPalette": "categorical"
          }
        }
      },
      "name": "query - 15"
    },
    {
      "type": 1,
      "content": {
        "json": "##  📌 Suspicious IPs (High failure count)"
      },
      "name": "text - 16"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AADNonInteractiveUserSignInLogs\r\n| where ResultType != 0 \r\n| summarize Failures = count() by IPAddress \r\n| where Failures > 10 \r\n| order by Failures desc",
        "size": 0,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Failures",
              "formatter": 8,
              "formatOptions": {
                "palette": "red"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "locInfoColumn": "Location",
          "latitude": "latitude_",
          "longitude": "longitude_",
          "sizeSettings": "count_",
          "sizeAggregation": "Sum",
          "labelSettings": "latitude_",
          "legendMetric": "count_",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "nodeColorField": "count_",
            "colorAggregation": "Sum",
            "type": "heatmap",
            "heatmapPalette": "categorical"
          }
        }
      },
      "name": "query - 15 - Copy"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-AADNonInteractiveUserSignInLogsWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}