Explanation:
Table to start from: MicrosoftGraphActivityLogs
Function to extract the path: parse_url(RequestUri).Path
To find which Azure resources were queried or modified by risky users, you should analyze API calls made to Microsoft Graph (and ARM where applicable) and join them with Identity Protection risk signals.
In Log Analytics, MicrosoftGraphActivityLogs records Graph API calls with useful fields for this task, including UserId, RequestUri, RequestMethod, ResponseStatusCode, and RequestId. These fields let you identify what resource endpoint was accessed, how (GET/POST/PATCH/DELETE), and whether the request succeeded.
You then join these API events with AADRiskyUsers on the user identifier ($left.UserId == $right.Id) to restrict results to users currently assessed as risky. To normalize the resource that was targeted, parse the endpoint from the full URL. The correct way is to extract just the path component using parse_url (RequestUri).Path, then clean version segments (e.g., /v1.0/, /beta/) with replace_string/replace_regex to produce a comparable resourcePath. Finally, summarizing with dcount(RequestId) by UserId, RiskState, resourcePath, RequestMethod, and ResponseStatusCode yields a concise mapping of which resources risky users queried or modified.
Therefore, the two correct choices are MicrosoftGraphActivityLogs and parse_url(RequestUri).Path.