azure - Kusto translation ID to Name

Question

I am new to kusto query and i need to translate app id to name of app. if i list just everything i get back lot of information and one of them is clientId - xxxxxx then i do a query where i list unique user per school with user ID. in other words i can see user per specific school per clientid (app). We have several apps users can use. I would like to extend this and do a translation that i know that this client ID is equal to this app from app registration. Any ideas how could i achieve that?

customEvents 
| where timestamp > ago(30d) and name == "SignInComplete"
| summarize dcount(tostring(customDimensions.ClientID)) by tostring(customDimensions.SchoolID), tostring(customDimensions.UserID)

question from:https://stackoverflow.com/questions/65916863/kusto-translation-id-to-name

Answer 1

SigninLogs
| extend AppName = case(AppId == "1b730954-1685-4b74-9bfd-dac224a7b894", "Global PowerShell",
AppId == "00000002-0000-0000-c000-000000000000", "Microsoft.Azure.ActiveDirectory",
AppId == "00000009-0000-0000-c000-000000000000", "Microsoft.Azure.AnalysisServices",
AppId == "00000005-0000-0000-c000-000000000000", "Microsoft.Azure.Workflow",
AppId == "0f698dd4-f011-4d23-a33e-b36416dcb1e6", "Microsoft Office Client Service",
AppId == "00000002-0000-0ff1-ce00-000000000000", "Microsoft.Exchange",
AppId == "00000007-0000-0ff1-ce00-000000000000", "Microsoft.ExchangeOnlineProtection",
AppId == "00000004-0000-0ff1-ce00-000000000000", "Microsoft.Lync",
AppId == "d3590ed6-52b3-4102-aeff-aad2292ab01c", "Microsoft Office",
AppId == "00000006-0000-0ff1-ce00-000000000000", "Microsoft.Office365Portal",
AppId == "00000003-0000-0ff1-ce00-000000000000", "Microsoft.SharePoint",
AppId == "4345a7b9-9a63-4910-a426-35363201d503", "O365 Suite UX",
AppId == "a0c73c16-a7e3-4564-9a95-2bdf47383716", "Office 365 Shell", 
AppId == "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7", "Office 365 Shell Suite",
AppId == "e48d4214-364e-4731-b2b6-47dabf529218", "Skype Web","")