SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| where RiskEventTypes_V2 has "anonymizedIPAddress" or NetworkLocationDetails has "anonymizer"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, RiskLevelDuringSignIn, RiskEventTypes_V2, ConditionalAccessStatus
| sort by TimeGenerated desc