View Query Audit Logs in Microsoft Sentinel

[@sarathkumaras]

Hi bro, can you help me with a KQL query to know who has done a " role assignment" for a given user

[@samikroy]

This query might help you AuditLogs | where OperationName == "Add member to role" | extend Target = tostring(TargetResources[0].userPrincipalName) | extend RoleAdded = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue))) | extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName) | project TimeGenerated, OperationName, Actor, Target, RoleAdded