Server Oriented Cmdlet And User Oriented Cmdlet used

Original query, unchanged.

let timeframe = 1d;
let spanoftime = 10m;
let threshold = 0;
ExchangeAdminAuditLogs 
  | where TimeGenerated > ago(2 * timeframe)
  | where isempty(UserOriented)
  | project serverExecutedTime = TimeGenerated,
    ServerCmdlet = CmdletName,
    ServerCmdletParams = CmdletParameters,
    Computer,
    Caller,
    ServerCmdletTargetObject = TargetObject
  | join kind= inner (
      ExchangeAdminAuditLogs
      | where TimeGenerated > ago(timeframe)
      | where UserOriented =~ 'Yes'
      | project userExecutedTime = TimeGenerated,
        UserCmdlet = CmdletName,
        UserCmdletParams = CmdletParameters,
        Computer,
        Caller,
        UserCmdletTargetObject = TargetObject,
        userPrincipalName,
        objectGUID,
        sAMAccountName,
        IsVIP)
    on Computer, Caller
  | where userExecutedTime - serverExecutedTime < spanoftime
  | extend TimeDelta = userExecutedTime - serverExecutedTime
  | extend TimeDeltaInverse = serverExecutedTime - userExecutedTime
  | where tolong(TimeDelta) >= threshold or tolong(TimeDeltaInverse) >= threshold