AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName == "Add member to role"
| extend RoleName = tostring(TargetResources[0].modifiedProperties[1].newValue)
| where RoleName has_any ("Global Administrator", "Privileged Role Administrator", "Exchange Administrator", "SharePoint Administrator", "Security Administrator")
| extend TargetUPN = tostring(TargetResources[0].userPrincipalName)
| extend InitiatedByUPN = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, TargetUPN, RoleName, InitiatedByUPN, CorrelationId
| sort by TimeGenerated desc