# bag\_unpack

```
IntuneDevices
| where TimeGenerated > ago (30d)
        and isnotempty(OS)
| distinct  OS, JoinType
| extend p = pack(OS, JoinType)
| summarize  bag = make_bag(p)
| evaluate bag_unpack(bag)
```

<figure><img src="https://3533425259-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbx8yn20QqNJtsVaH9CY7%2Fuploads%2FPLsyKkKmfTdU5Book2ZB%2Fimage.png?alt=media&#x26;token=c0a0d88d-817e-4f24-a916-74188f39c010" alt=""><figcaption></figcaption></figure>

```
SigninLogs
| where TimeGenerated > ago(1d)
| evaluate bag_unpack(DeviceDetail)
| distinct UserPrincipalName, displayName, operatingSystem, trustType
```

<figure><img src="https://3533425259-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbx8yn20QqNJtsVaH9CY7%2Fuploads%2FRJCoRIMeGC8mdGBWgFvw%2Fimage.png?alt=media&#x26;token=70d4e0f6-12d2-48aa-af3f-b1dd4b78471a" alt=""><figcaption></figcaption></figure>