Query: activedirectory_user_sign_in_report

select
  id as "ID",
  created_date_time as "Create Time",
  app_display_name as "App Display Name",
  client_app_used as "Client App Used"
from
  azuread_sign_in_report
where
  user_id = split_part($1, '/', 1)
  and tenant_id = split_part($1, '/', 2)
order by
  created_date_time desc
limit 5;