Hi @Vasil Michev ,
Really sorry for being so cheeky!
May I please request another clarification on below:
I'm using below query in KQL to get the last login data for users (this basically gets me the data of all such users who haven't logged in for 30 to 90 days), what should be the trusted and recommended way if one wants to choose between the KQL and the Mg Graph cmdlets to get this (as you also have mentioned in your blog that this cmdlet still has some issues such as differentiate between failed and successful sign-in attempts etc.)
SigninLogs
| where TimeGenerated > ago(90d)
| where UserType == "Member"
| where UserPrincipalName endswith "@xyz.com"
| summarize arg_max(TimeGenerated, *) by tolower(UserPrincipalName)
| project UserPrincipalName, TimeGenerated = format_datetime(TimeGenerated, "dd-MM-yyyy HH:mm:ss"), ["DaysSinceLastLogon"]=datetime_diff("day", now(), TimeGenerated)
| where ["DaysSinceLastLogon"] >= 30
| sort by ["DaysSinceLastLogon"] desc
| project UserPrincipalName, LastLoginTime = TimeGenerated