Explanation:
Dropdown/Step
Value to Select
where ResponseStatusCode in (...)
("204")
split([dropdown], "/")[-3]
RequestUri
To detect Microsoft Graph operations that change role membership, you target POST requests to the directoryRoles ... /members/$ref endpoint. Adding a member to a role via Microsoft Graph is performed with POST /directoryRoles/{role-id}/members/$ref and, on success, Graph returns HTTP 204 No Content.
Therefore, filtering ResponseStatusCode to 204 isolates successful role-assignment events while excluding errors like 401/403 and non-mutating redirects such as 302.
The RequestUri contains the role identifier in the path. For URIs like:
https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members/$ref
splitting on "/" yields: [https:, , graph.microsoft.com, v1.0, directoryRoles, {role-id}, members, $ref]. The element at index -3 is the {role-id}. Hence, extend Role = tostring(split(RequestUri, "/")[-3]) correctly extracts the role GUID for reporting.
Putting it together, a concise query is:
MicrosoftGraphActivityLogs
| where RequestUri has_all ("https://graph.microsoft.com/", "/directoryRoles", "members/$ref")
| where RequestMethod == "POST"
| where ResponseStatusCode in ("204")
| extend Role = tostring(split(RequestUri, "/")[-3])
| project TimeGenerated, IPAddress, ResponseStatusCode, Role
This returns the timestamp, source IP, success code, and the affected role ID for each successful role- membership addition in your tenant.