Use Endpoint Manager to monitor user login duration

Question

We are having issue where new account creations on Windows 10 devices can take up to 15mins. I would like to be able to use Endpoint Manager to examine the login duration and what specifically is causing the delay. Are there any current reports or analytics that will provide this information.
If this is not available in Endpoint Manger can you please advise where I can obtain the relevant information such as event viewer or audit logs.

Answer 1

Here is a sample KQL query based on Security events in Sentinel with a similar goal. You may be able to create a similar Advanced Query in MDE if you can find a logon and logoff indicator in the logs.

let login = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == '4624'
| project TargetLogonId, loginTime = TimeGenerated;
let logout = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == '4634'
| project TargetLogonId, logoutTime = TimeGenerated;
login
| join kind=leftouter logout on TargetLogonId
| project loginTime, logoutTime