from * metadata _id, _index, _version | where operationName=="MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE" and status=="Success" and (requestBody like "*8e3af657-a8ff-443c-a75c-2fe8c4bcb635*" or requestBody like "*18d7d88d-d35e-4fb5-a5c3-7773c20a72d9*")
