WesSec

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
// Filter for Company portal
| where AppId == "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223"
// Filter for the Windows Azure AD api
| where ResourceIdentity == "00000002-0000-0000-c000-000000000000" 
| extend parseddevice = parse_json(DeviceDetail)
// Filter for devices without DeviceID (those are non joined devices, likely an attacker)
| where isempty(parseddevice.deviceId)
// Filter operating systems or devices in the enviroment which are known non joined

bcse