{
    "authorization": {
        "action": "Microsoft.Authorization/roleAssignments/write",
        "scope": "/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e"
    },
    "caller": "xxx@gmail.com",
    "channels": "Operation",
    "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/3adxxx/",
        "iat": "1748432056",
        "nbf": "1748432056",
        "exp": "1748437378",
        "http://schemas.microsoft.com/claims/authnclassreference": "1",
        "acrs": "p1",
        "aio": "AcQAO/8ZAAAAFcxS2htdfGhr/+fyVnRtgDUmFA8FDbkWEWCtTmSbMJ+igom1BnldAX9zadkA8/PtJgh8elSNnmp0STMKxMUq+D31sXeeWv1jpm5XGguIBYc8e1PobZZzgNfPovCJbmLvnIT6LLeDJK1LjAThT4Hmwj8vq1kUhX4KZAgwGURdPVx3wsHFsPnucDKC43sP17AGGih8fdbNzpwkGwAc48Ycp5ZQr1WZt8LhqzABkV+LdXhk2qzrAEZa/qwmkExEJOMT",
        "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
        "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
        "appidacr": "2",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Jain",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Zeel",
        "groups": "a89aaba2-e38f-4bc1-820d-740b8600b06d,21a488eb-f1d1-47c7-8c61-150de3d7ee3d,d1f8142b-6c1a-49a1-a049-c1e47e82cc30",
        "idtyp": "user",
        "ipaddr": "103.108.207.58",
        "name": "Zeel Jain",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "e347ee55-f06e-40d6-b65a-cbcb3d0336e1",
        "puid": "10032003B8A40432",
        "pwd_exp": "78187",
        "pwd_url": "https://portal.microsoftonline.com/ChangePassword.aspx",
        "rh": "1.AXIAPJbbOmGO6EigbW27DazqOUZIf3kAutdPukPawfj2MBMwAZFyAA.",
        "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
        "sid": "005098e9-73be-8e19-3d43-10d112496129",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "T1GpURwuK3f7J02sIG9ryPrVGSY34llsogoKkelIROM",
        "http://schemas.microsoft.com/identity/claims/tenantid": "3adxxx",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "xxx@gmail.com",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "xxx@gmail.com",
        "uti": "B5LRvwnZ606m1dhgt5pAAA",
        "ver": "1.0",
        "wids": "62e90394-69f5-4237-9190-012177145e10,9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "xms_ftd": "nnIVAWAuCScGjh-3o4vWFyFr9PhH43CP34rq0ubw1eYBYXNpYXNvdXRoZWFzdC1kc21z",
        "xms_idrel": "8 1",
        "xms_tcdt": "1439292748"
    },
    "correlationId": "63b47ac7-9624-4d6c-9577-31b9d5d44975",
    "description": "",
    "eventDataId": "ca4b0c6f-5e72-4250-8344-fda9d3ff8d1b",
    "eventName": {
        "value": "BeginRequest",
        "localizedValue": "Begin request"
    },
    "category": {
        "value": "Administrative",
        "localizedValue": "Administrative"
    },
    "httpRequest": {
        "clientRequestId": "04f9ca95-d3c8-4849-a88f-160bcf9fd00d",
        "clientIpAddress": "163.116.212.64",
        "method": "PUT",
        "uri": "https://management.azure.com/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e?api-version=2019-04-01-preview"
    },
    "id": "/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e/events/ca4b0c6f-5e72-4250-8344-fda9d3ff8d1b/ticks/638840314982150319",
    "level": "Informational",
    "resourceGroupName": "r15-xxx",
    "resourceProviderName": {
        "value": "Microsoft.Authorization",
        "localizedValue": "Microsoft.Authorization"
    },
    "resourceId": "/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e",
    "resourceType": {
        "value": "Microsoft.Authorization/roleAssignments",
        "localizedValue": "Microsoft.Authorization/roleAssignments"
    },
    "operationId": "63b47ac7-9624-4d6c-9577-31b9d5d44975",
    "operationName": {
        "value": "Microsoft.Authorization/roleAssignments/write",
        "localizedValue": "Create role assignment"
    },
    "properties": {
        "requestbody": "{\"properties\":{\"roleDefinitionId\":\"/providers/Microsoft.Authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa\",\"principalId\":\"fbd841a9-859f-4dfb-8647-d293e4e9fdee\",\"principalType\":\"ServicePrincipal\"}}",
        "eventCategory": "Administrative",
        "entity": "/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e",
        "message": "Microsoft.Authorization/roleAssignments/write",
        "hierarchy": "3adxxx/e06xxx"
    },
    "status": {
        "value": "Started",
        "localizedValue": "Started"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "eventTimestamp": "2025-05-28T12:18:18.2150319Z",
    "submissionTimestamp": "2025-05-28T12:24:00Z",
    "subscriptionId": "e06xxx",
    "tenantId": "3adxxx"
}
{
    "channels": "Operation",
    "correlationId": "63b47ac7-9624-4d6c-9577-31b9d5d44975",
    "description": "Alert: Create role assignment called on action groups : it_alert",
    "eventDataId": "ca4b0c6f-5e72-4250-8344-fda9d3ff8d1b",
    "eventName": {
        "value": "",
        "localizedValue": ""
    },
    "category": {
        "value": "Alert",
        "localizedValue": "Alert"
    },
    "id": "/subscriptions/e06xxx/resourceGroups/CRESTIT/providers/microsoft.insights/activityLogAlerts/Create+role+assignment/events/ca4b0c6f-5e72-4250-8344-fda9d3ff8d1b/ticks/638840319216460097",
    "level": "Informational",
    "resourceGroupName": "r15-xxx",
    "resourceProviderName": {
        "value": "microsoft.insights",
        "localizedValue": "Microsoft Insights"
    },
    "resourceId": "/subscriptions/e06xxx/resourceGroups/CRESTIT/providers/microsoft.insights/activityLogAlerts/Create role assignment",
    "resourceType": {
        "value": "microsoft.insights/activitylogalerts",
        "localizedValue": "microsoft.insights/activitylogalerts"
    },
    "operationId": "",
    "operationName": {
        "value": "Microsoft.Insights/ActivityLogAlerts/Activated/action",
        "localizedValue": "Activity Log Alert activated"
    },
    "properties": {
        "subscriptionId": "e06xxx",
        "tenantId": "3adxxx",
        "eventDataId": "ca4b0c6f-5e72-4250-8344-fda9d3ff8d1b",
        "resourceGroup": "r15-xxx",
        "resourceId": "/subscriptions/e06xxx/resourcegroups/r15-xxx/providers/microsoft.operationalinsights/workspaces/comcastxdr/providers/Microsoft.Authorization/roleAssignments/5b883aaa-e648-4fa2-bc15-0af62a19e00e",
        "eventTimestamp": "5/28/2025 12:18:18 PM",
        "operationName": "Microsoft.Authorization/roleAssignments/write",
        "status": "Started"
    },
    "status": {
        "value": "Succeeded",
        "localizedValue": "Succeeded"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "eventTimestamp": "2025-05-28T12:25:21.6460097Z",
    "submissionTimestamp": "2025-05-28T12:25:21.6460097Z",
    "subscriptionId": "e06xxx",
    "tenantId": "3adxxx"
}