# Entra ## Find Accounts that have been disabled in the last 90 days ```kql AuditLogs | where TimeGenerated > ago(90d) | where OperationName contains "Disable account" | summarize arg_max(ActivityDateTime, *) by tostring(TargetResources[0].userPrincipalName) | project ActivityDateTime, OperationName, InitiatedBy.user.userPrincipalName, TargetResources[0].userPrincipalName, TargetResources[0].id ```