bag_unpack

IntuneDevices
| where TimeGenerated > ago (30d)
        and isnotempty(OS)
| distinct  OS, JoinType
| extend p = pack(OS, JoinType)
| summarize  bag = make_bag(p)
| evaluate bag_unpack(bag)

SigninLogs
| where TimeGenerated > ago(1d)
| evaluate bag_unpack(DeviceDetail)
| distinct UserPrincipalName, displayName, operatingSystem, trustType