Dataverse - Audit logging disabled

Original query, unchanged.

let query_frequency = 1h;
let audit_properties = dynamic(['isauditenabled', 'isuseraccessauditenabled','isreadauditenabled']);
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message in~ ("Update", "UpdateAuditSettings")
| where Fields has_any (audit_properties)
| mv-expand Fields
| extend AuditValue = Fields.Name, AuditEnabled = tobool(Fields.Value)
| where AuditValue in~ (audit_properties) and not (AuditEnabled)
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    OriginalObjectId,
    AuditValue,
    AuditEnabled,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix