KQL, short for Kusto Query Language, is really great for quering data sets like Sign-in Logs and Audit Logs in Azure AD. KQL is what Microsoft Sentinel uses under the hood for discovering threats, detections and anomalies in larger data sets. But you can also use it to retrieve simpler log entries like: Who deleted a specific user. How often is a user elevating into an Azure AD administrative role in PIM. When was a user added to or removed from a specific Azure AD security group.
