// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Directory events that name the supplier's apps or service principals as targets.
let SupplierObjectIds = dynamic(["REPLACE_WITH_APP_OR_SERVICE_PRINCIPAL_OBJECT_ID"]);
let WindowStart = datetime(2026-01-01T00:00:00Z);  // REPLACE: exposure start, UTC
AuditLogs
| where TimeGenerated between (WindowStart .. now())
| mv-expand Target = TargetResources
| where tostring(Target.id) in~ (SupplierObjectIds)
| summarize arg_max(TimeGenerated, *) by Id
| project TimeGenerated, Id, OperationName, Result, InitiatedBy,
    TargetResources, CorrelationId
| order by TimeGenerated asc
| take 500