Explanation:

For a near-real-time (NRT) analytics rule that detects sign-ins by a designated break-glass account, the most direct and performant pattern is to filter SigninLogs by joining to a Microsoft Sentinel watchlist that contains the protected account(s). Sentinel exposes watchlists to KQL through the helper function
_GetWatchlist( ' < watchlist-name > ' ) , which returns a table with standard columns (including SearchKey ) plus any custom columns you imported. Using join kind=inner ensures the result set includes only those SigninLogs rows whose UserPrincipalName matches an entry in the watchlist-ideal for alerting on a high- value account without post-filtering.
The completed query is:
SigninLogs | join kind=inner (_GetWatchlist( ' breakglass_account ' )) on $left.UserPrincipalName == $right.
SearchKey
This approach satisfies the requirement to implement an NRT rule for the break-glass account because:
* NRT rules support KQL with joins and watchlists and are optimized for rapid evaluation over fresh data.
* Using a watchlist lets SecOps adjust monitored accounts without editing the rule-minimizing administrative effort and aligning with least-privilege operations (no extra permissions beyond watchlist management).
* The inner join pattern reduces noise by returning only matched events, which are then turned into alerts
/incidents by the NRT rule.
Thus, select join and GetWatchlist , and join UserPrincipalName to the watchlist's SearchKey .

Reference:
https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

https://learn.microsoft.com/en-us/defender-cloud-apps/connect-office-365