Emergency access accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 06f84e1 · +1 −3 lines · also on GitHub
⋯ 117 unchanged lines
118118
119119
> [!NOTE]
120120
> For each additional emergency access account you want to include, add another `or UserId == "ObjectGuid"` to the query.
121
− >
122
− > The table name in these queries depends on your workspace type. Use `SigninLogs` for standard Log Analytics workspaces, or `AADSignInLogs` for Microsoft Sentinel workspaces.
123121
124122
Sample queries:
125123
```kusto
⋯ 28 unchanged lines
154152
1. Set the **Threshold value** to **0**.
155153
1. Set the **Frequency of evaluation** to how often you want the query to run.
156154
157
− :::image type="content" source="./media/security-emergency-access/alert-logic.png" alt-text="Screenshot of Alert logic settings with example values for Threshold type, Operator, Threshold vlaue, and Frequency of evaluation." lightbox="./media/security-emergency-access/alert-logic.png":::
155
+ :::image type="content" source="./media/security-emergency-access/alert-logic.png" alt-text="Screenshot of Alert logic settings with example values for Threshold type, Operator, Threshold value, and Frequency of evaluation." lightbox="./media/security-emergency-access/alert-logic.png":::
158156
159157
1. Select **Next** to proceed.
160158
⋯ 75 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.