AzureActivity
| where OperationNameValue =~ "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE" and ActivityStatusValue =~ "Success" and (Properties contains "8e3af657-a8ff-443c-a75c-2fe8c4bcb635" or Properties contains "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9")
