mv-expand

​
SigninLogs
| project TimeGenerated, UserPrincipalName, ConditionalAccessPolicies
| mv-expand ConditionalAccessPolicies
SigninLogs
| project TimeGenerated, UserPrincipalName, ConditionalAccessPolicies
| mv-expand ConditionalAccessPolicies
| evaluate bag_unpack(ConditionalAccessPolicies)
| mv-expand enforcedGrantControls
| project TimeGenerated, UserPrincipalName, displayName, enforcedGrantControls, result
​
​