Tailscale: User role elevated to admin or owner

Original query, unchanged.

let elevated = dynamic(["admin", "network-admin", "owner"]);
let recent =
    Tailscale_Users_CL
    | where TimeGenerated > ago(1h)
    | summarize arg_max(TimeGenerated, *) by UserId
    | where Role in (elevated)
    | project UserId, LoginName, RoleNow = Role;
let prior =
    Tailscale_Users_CL
    | where TimeGenerated between (ago(2d) .. ago(1h))
    | summarize arg_max(TimeGenerated, *) by UserId
    | project UserId, RolePrior = Role;
recent
| join kind=inner prior on UserId
| where RoleNow != RolePrior
| where RolePrior !in (elevated)
| project TimeGenerated = now(), UserId, LoginName, RolePrior, RoleNow