WesSec

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
// Filter for Company portal
| where AppId == "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223"
// Filter for the Windows Azure AD api
| where ResourceIdentity == "00000002-0000-0000-c000-000000000000" 
| extend parseddevice = parse_json(DeviceDetail)
// Filter for devices without DeviceID (those are non joined devices, likely an attacker)
| where isempty(parseddevice.deviceId)
// Filter operating systems or devices in the enviroment which are known non joined

WesSec

<Query>
| extend values = pack_all()
| mv-apply values on 
(
    mv-expand kind = array  values
    | where isnotempty(values[1])
    | summarize EmptyValuesRemoved = make_bag(pack(tostring(values[0]), values[1]))
)
| project EmptyValuesRemoved
| evaluate bag_unpack(EmptyValuesRemoved)