SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| summarize IPs = dcount(IPAddress), Locations = dcount(Location) by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 15m)
| where IPs > 1 and Locations > 1
| join kind=inner (
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| project UserPrincipalName, IPAddress, UserAgent
) on UserPrincipalName