// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Return events initiated by the user OR naming the user as a target.
let TargetUserId = "REPLACE_WITH_ENTRA_USER_OBJECT_ID";
AuditLogs
| where TimeGenerated between (ago(24h) .. now())
| extend ActorId = tostring(InitiatedBy.user.id),
    Targets = iff(coalesce(array_length(TargetResources), 0) == 0, dynamic([{}]), TargetResources)
| mv-expand Target = Targets
| extend TargetId = tostring(Target.id)
| where ActorId =~ TargetUserId or TargetId =~ TargetUserId
| summarize arg_max(TimeGenerated, *) by Id
| project TimeGenerated, Id, OperationName, Result, InitiatedBy,
    TargetResources, CorrelationId
| order by TimeGenerated asc
| take 500