SAP BTP - User added to Cloud Identity Service privileged Administrators list

Original query, unchanged.

let monitored_permissions = dynamic(["ManageIdP", "ManageSP", "ManageUsers", "ReadUsers", "ManageAccess", "ManageGroups"]);
SAPBTPAuditLog_CL
| extend data_s = tostring(Message.data)
| extend action = extract(@"action=""([^""]+)""", 1, data_s),
         state = extract(@"state=""([^""]+)""", 1, data_s),
         changedAttribute = extract(@"changedAttribute=""([^""]+)""", 1, data_s),
         newValue = extract(@"newValue=""([^""]+)""", 1, data_s),
         targetUser = extract(@"userIdentifier=""([^""]+)""", 1, data_s),
         callerMail = extract(@"callerMail=""([^""]+)""", 1, data_s),
         ipAddress = extract(@"ipAddress=""([^""]+)""", 1, data_s)
| where action == "grantPermissions"
| where state == "successful"
| where changedAttribute == "authorizations"
| where isnotempty(newValue)
| mv-expand permission = monitored_permissions
| where newValue contains tostring(permission)
| summarize 
    GrantedPermissions = make_set(newValue, 10),
    MatchedPermissions = make_set(tostring(permission), 10)
    by UpdatedOn, UserName, callerMail, targetUser, Tenant, ipAddress
| project UpdatedOn, UserName, callerMail, targetUser, GrantedPermissions, MatchedPermissions, Tenant, ipAddress, CloudApp = "SAP Cloud Identity Service"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]