KQL_azureactivity_new_role_assignments

// Show all new Azure Role assignments
AzureActivity
| where ResourceProvider == "Microsoft.Authorization'
    and OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
    and ActivityStatus == "Succeeded"