Even this wrong. I'm going nuts.
index=azuread sourcetype=ms:aad:signin appDisplayName="Microsoft Teams"
| eval tempField=mvzip(mvzip('appliedConditionalAccessPolicies{}.conditionsNotSatisfied','appliedConditionalAccessPolicies{}.conditionsSatisfied','appliedConditionalAccessPolicies{}.displayName','appliedConditionalAccessPolicies{}.enforcedGrantControls{}','appliedConditionalAccessPolicies{}.enforcedSessionControls{}','appliedConditionalAccessPolicies{}.id'),'appliedConditionalAccessPolicies{}.result')
| stats count by _time, tempField
| eval 'appliedConditionalAccessPolicies{}.conditionsNotSatisfied'=mvindex(split(tempField,","),0),
'appliedConditionalAccessPolicies{}.conditionsSatisfied'=mvindex(split(tempField,","),1),
'appliedConditionalAccessPolicies{}.displayName'=mvindex(split(tempField,","),2),
'appliedConditionalAccessPolicies{}.enforcedGrantControls{}'=mvindex(split(tempField,","),3),
'appliedConditionalAccessPolicies{}.enforcedSessionControls{}'=mvindex(split(tempField,","),4),
'appliedConditionalAccessPolicies{}.id'=mvindex(split(tempField,","),5),
'appliedConditionalAccessPolicies{}.result'=mvindex(split(tempField,","),6)
|table alternateSignInName appliedConditionalAccessPolicies{}.conditionsNotSatisfied appliedConditionalAccessPolicies{}.conditionsSatisfied appliedConditionalAccessPolicies{}.displayName appliedConditionalAccessPolicies{}.enforcedGrantControls{} appliedConditionalAccessPolicies{}.enforcedSessionControls{} appliedConditionalAccessPolicies{}.id appliedConditionalAccessPolicies{}.result
... View more