Role Assignment To Restricted Management Admin Unit RMAU
Query
AuditLogs
| where OperationName == "Add member to role scoped over Restricted Management Administrative Unit"
//TargetResources[1].id is the Object ID of the RMAU
// The identity performing the action from a log PoV will be the MS-PIM identity as expectedExplanation
This query is searching through audit logs to find specific events where a member was added to a role within a "Restricted Management Administrative Unit" (RMAU). It filters the logs to only show entries where the operation performed was "Add member to role scoped over Restricted Management Administrative Unit." Additionally, it notes that the second item in the "TargetResources" array contains the Object ID of the RMAU, and the identity performing the action in the logs will be the Microsoft Privileged Identity Management (MS-PIM) identity.