Dataverse - Bulk record ownership re-assignment or sharing

Original query, unchanged.

// Set threshold for number of shared/assigned records
let detection_threshold = 100;
let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message in ("ModifyAccess", "Assign", "GrantAccess")
| summarize
    FirstEvent = min(TimeGenerated),
    LastEvent = max(TimeGenerated),
    Events = count()
    by UserId, Message, InstanceUrl, ClientIp
| where Events > detection_threshold
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    FirstEvent,
    LastEvent,
    Message,
    Events,
    UserId,
    ClientIp,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix