Explanation:
Dropdown/Step
Value to Select
where ResponseStatusCode in (...)
( " 204 " )
split([dropdown], " / " )[-3]
RequestUri
To detect Microsoft Graph operations that change role membership , you target POST requests to the directoryRoles ... /members/$ref endpoint. Adding a member to a role via Microsoft Graph is performed with POST /directoryRoles/{role-id}/members/$ref and, on success, Graph returns HTTP 204 No Content .
Therefore, filtering ResponseStatusCode to 204 isolates successful role-assignment events while excluding errors like 401/403 and non-mutating redirects such as 302.
The RequestUri contains the role identifier in the path. For URIs like:
https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members/$ref
splitting on "/" yields: [https:, , graph.microsoft.com, v1.0, directoryRoles, {role-id}, members, $ref] . The element at index -3 is the {role-id} . Hence, extend Role = tostring(split(RequestUri, " / " )[-3]) correctly extracts the role GUID for reporting.
Putting it together, a concise query is:
MicrosoftGraphActivityLogs
| where RequestUri has_all ( " https://graph.microsoft.com/ " , " /directoryRoles " , " members/$ref " )
| where RequestMethod == " POST "
| where ResponseStatusCode in ( " 204 " )
| extend Role = tostring(split(RequestUri, " / " )[-3])
| project TimeGenerated, IPAddress, ResponseStatusCode, Role
This returns the timestamp, source IP, success code, and the affected role ID for each successful role- membership addition in your tenant.