Explanation:

To hunt for resource changes in an Azure subscription via Microsoft Sentinel, the correct telemetry source is the AzureActivity table. Microsoft documents state that Azure Activity logs record control-plane operations against Azure resources (e.g., create/update/delete) and include fields such as OperationNameValue, ActivityStatusValue, Caller, ResourceId, and EventSubmissionTimestamp. Filtering with OperationNameValue endswith "write" captures change operations (create/update), while ActivityStatusValue
== "Succeeded" ensures only successful changes are counted. For time-series analysis over fixed intervals and to substitute missing data points with 0, use the KQL make-series operator with the default=0 parameter. This operator builds per-principal daily series using on EventSubmissionTimestamp in range(ago (7d), now(), 1d) by Caller, and dcount(ResourceId) (or count()) returns the number of resource changes each day per Microsoft Entra security principal. This aligns with Sentinel hunting best practices: use AzureActivity for subscription-level changes, filter to succeeded writes, and leverage make-series to produce a 7-day daily series with zero-fill for gaps-minimizing false impressions caused by missing events.
Final KQL:
AzureActivity
| where OperationNameValue endswith "write"
| where ActivityStatusValue == "Succeeded"
| make-series dcount(ResourceId) default=0
on EventSubmissionTimestamp in range(ago(7d), now(), 1d)
by Caller