{"CreationTime": "2023-09-11T15:55:46", "Id": "8c9c938b-79d5-44b1-8581-de51fafa8216", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"1\",\"b\":\"{\\\"targetUpdatedProperties\\\":\\\"[{\\\\\\\"Name\\\\\\\":\\\\\\\"AssignedLicense\\\\\\\",\\\\\\\"OldValue\\\\\\\":[\\\\\\\"[SkuName=SPE_E5, AccountId=bbad9541-eb53-4533-bcef-2b76182c3b75, SkuId=06ebc4ee-1bb5-47dd-8120-11324bc54e06, DisabledPlans=[M365_ADVANCED_AUDITING]]\\\\\\\"],\\\\\\\"NewValue\\\\\\\":[\\\\\\\"[SkuName=SPE_E5, AccountId=bbad9541-eb53-4533-bcef-2b76182c3b75, SkuId=06ebc4ee-1bb5-47dd-8120-11324bc54e06, DisabledPlans=[]]\\\\\\\"]},{\\\\\\\"Name\\\\\\\":\\\\\\\"AssignedPlan\\\\\\\",\\\\\\\"OldValue\\\\\\\":[{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"023234e8-a87e-4ba4-8814-da5609cd4426\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"TeamspaceAPI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"57ff2da0-773e-42df-b2af-ffb7a2317929\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"072b9cb4-3176-43e6-882e-49b8836bf50b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7547a3fe-08ee-4ccb-b430-5077c5041653\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0a63ee3c-4c54-462d-a1c2-5766416685fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a82fbf69-b4d7-49f4-83a6-915b2cf354f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0cd40d66-4fdd-4871-9af2-3e383b200b5d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"afa73018-811e-46e9-988f-f75d2b1b8430\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"14faac42-bc6a-4c64-b309-6251c4cb09e2\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5136a095-5cf0-4aff-bec3-e84448b38ea5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1be931f9-9c0d-4148-a4ad-b61c221bc223\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftThreatProtection/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf28f719-7844-4079-9c78-c1307898e192\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1cfbcaa7-abeb-483d-a197-7e36348ed0f8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb0351d-3b08-4503-993d-383af8de41e3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"213dbe99-be20-4464-af87-54d0094fd6ce\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"eec0eb4f-6444-4f95-aba0-50c24d67f998\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"21765469-dcd6-4192-ab8a-e3f6bd760822\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b8afc642-032e-4de5-8c0a-507a7bba7e5d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"227b5826-9349-4504-97a3-81b1da2bbfbb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"531ee2f8-b1cb-453b-9c21-d2180d014ca5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"23cab049-6eee-4aac-9595-f9b02af3373b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AzureAdvancedThreatAnalytics/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"14ab5db5-e6c4-4b20-b4bc-13e36fd2227f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"26a3d64a-198f-465b-a641-c3f8266f1ea5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4828c8ec-dc2e-4779-b502-87ac9ce28ab7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2a3c7121-f4fe-46d1-9b5f-e93c865bf6dc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2b092686-43fd-40d2-9f20-794390aa1c16\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c4801e8a-cb58-4c35-aca6-f2dcc106f287\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2c310eeb-327e-4bfc-9235-69386c3a8ce1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c098270-9dd4-4350-9b30-ba4703f3b36b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"378cc2d1-7489-4372-b3c0-2179a6e8c72d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SCO/PROD_AMSUA0102_02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c1ec4a95-1f05-45b3-a911-aa3fa01094f5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39d44552-2bd6-4599-803e-3ccfd4b6502a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9d0c4ee5-e4a1-4625-ab39-d82b619b1a34\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39e9d742-53f6-4acc-a844-4fa26478de82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b1188c4c-1b36-4018-b48b-ee07604f6feb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3bdaaeba-01a4-4b77-ba29-54845686b4af\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0feaeb32-d00e-4d66-bd5a-43b5b83db82c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3f2de5ba-2779-4e4b-b720-7abc47df4af5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"28b0fa46-c39a-4188-89e2-58e979a6b014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"426015f6-326a-41d7-bae4-82254ed4578d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"42a3adf0-6a2c-44df-b8bc-e435eb6aeb73\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d2d51368-76c9-4317-ada2-a12c004c432f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4b4b9b47-92ef-462c-aa50-afb777483ef4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e95bec33-7c88-4a70-8e19-b10bd9d0c014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4bd6d0f1-692a-4626-b03f-1d72feaa8d7c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Office365InsiderRisk/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d587c7a3-bda9-4f99-8776-9bcf59c84f75\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4fd93da9-971e-45ae-a2dc-51154f0d174e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5dbe027f-2339-4123-9542-606e4d348a72\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5013f49d-b578-4a2d-9106-4dd025ef97b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5689bec4-755d-4753-8b61-40975025187c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"52cc074b-6308-4a8e-9c6c-5d3ac6175b6c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0683001c-0492-4d59-9515-d9a6426b5813\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5638cb0f-dcef-4ee1-977b-7f17c177c847\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c7699d2e-19aa-44de-8edf-1736da088ca1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5960bdc8-5438-48cd-ab81-9c8815046666\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"65cc641f-cccd-4643-97e0-a17e3045e541\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"59956027-42b4-4311-b7f3-9de3c2f82f29\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftPrint/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"795f6fe0-cc4d-4773-b050-5dde4dc704c9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5edcb9dd-550c-4fe7-a208-0e500b1c311c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9c0dab89-a30c-4117-86e7-97bda240acd2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"609eaebf-31a9-49f6-a079-b6b130d4b1f0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectWorkManagement/PROD_NA_Org_Ring_100\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b737dad2-2f6c-4c65-90e3-ca563267e8b9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6632a0f5-bc7a-4c76-8ed9-0ba7b5f279bc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0898bdbb-73b0-471a-81e5-20f1fe4dd66e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"695f03a0-fa15-4b83-b4c5-312936e82361\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\"\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:55:46", "Id": "ab1b16be-3ac6-46dd-af63-09253ee40a72", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"2\",\"b\":\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"07699545-9485-468e-95b6-2fca3738be01\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6aec41c1-6a8d-4679-b02b-aa3a193bbcf4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e26c2fcc-ab91-4a61-b35c-03cdc8dddf66\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b5f4303-b2f2-4bcc-be5a-06380b6d06bd\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41fcdd7d-4733-4863-9cf4-c65b83ce2df4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b77f0c5-82bc-4af7-bbd5-c811004b982d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb87545-963c-4e0d-99df-69c6916d9eb0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6f38451f-2490-4a83-a681-dd6af213f6e1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"34c0d7a0-a70f-4668-9238-47f9fc208882\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7065758c-18a7-4c4e-8e78-774ce2ad1097\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"199a5c09-e0ca-4e37-8f7c-b05d533e1ea2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"758ac54c-4359-4497-8074-980f45bf9381\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c57d4b6-3b23-47a5-9bc9-69f17b4947b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"765993af-af8f-4e10-9fed-a91a02c93a8f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0f9b09cb-62d1-4ff4-9129-43f4996f83f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"78e169e0-1454-4568-8dfd-e5fe3edc4d13\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"617b097b-4b93-4ede-83de-5f075bb5fb2f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7b60a390-3a7f-49da-99cc-69ba7be50496\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"54fc630f-5a40-48ee-8965-af0503c1386e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"87787d52-8c6b-44b1-8125-0226a3493838\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"LearningAppServiceInTeams/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b76fb638-6ba6-402a-b9f9-83d28acb3d86\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"89dc8e14-e648-4d2e-a75f-a2aae3677148\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4a51bca5-1eff-43f5-878c-177680f191af\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"8b94b539-5ab2-4a55-b4db-7e5672ed55a9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4de31727-a228-4ec3-a5bf-8e45b5ca48cc\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9055b9b6-ca02-4c07-8382-ef7586cd70b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Sway/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a23b959c-7ce8-4e57-9140-b90eb88a9e97\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"990c2a47-fd1a-44d2-87e1-24c8c7897c48\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"159f4cd6-e380-449f-a816-af1a9ef76344\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9e507025-d62e-4a7f-9ab1-55936e76196b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3fb82609-8c27-4f7b-bd51-30634711ee67\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9ff42d12-3bb8-4aa6-bbd7-23fb3971bc4c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"46129a58-a698-46f0-aa5b-17f6586297d9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0ba641c-2a64-436d-a8d3-e529abe19088\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerBI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"70d33638-9c74-4d01-bfd3-562de28bd4ba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0df4d58-7374-4b6b-a87f-23b3184cc422\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6dc145d6-95dd-4191-b9c3-185575ee6f6b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a234acf4-3a37-4c4a-81a5-0036757cce0e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"33c4f319-9bdd-48d6-9c4d-410b750a4a5a\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a2ef8d0a-c987-41bd-b836-1db72a7c227b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41781fb2-bc02-4b7c-bd55-b576c07bb09d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a5507169-ef95-4a37-8093-83db94a8cc1a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a1ace008-72f3-4ea0-8dac-33b3a23a2472\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a61bae3c-b11f-482e-8462-4ba97abcc71f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Windows/SDF\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"21b439ba-a0ca-424f-a6cc-52f954a5b111\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a744b8d6-1722-43b9-a160-e70185899ba0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c6042f5-6f01-4d67-b8c1-eb99d36eed3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"aa9e96b5-f0d7-4365-a72d-0455bc0fb033\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MIPExchangeSolutions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"cd31b152-6326-4d1b-ae1b-997b625182e6\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"adbf350a-69fc-4555-b8cd-ae15fe526691\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"ded3d325-1bdc-453e-8432-5bac26d7a014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b110480e-8100-4062-a249-d83f17e8600c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MultiFactorService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8a256a2b-b617-496d-b51b-e76466e88db0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b246d987-2ad4-4f05-a88e-83fd774338c0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9f431833-0334-42de-a7dc-70aa40db46db\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b6604393-a3bd-47cf-b253-e6e8df62d3f1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"43de0ff5-c92c-492b-9116-175376d08c38\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b7f29e4e-3769-407f-b6b3-8dae5ee904fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3c53ea51-d578-46fa-a4c0-fd0a92809a60\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ba289b1a-4798-491e-a84d-8a89b7a297a1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e212cbc7-0961-4c40-9825-01117710dcb1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"baa8ba1c-b8d6-4888-9083-0c081fbb0e7a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bea4c11e-220a-4e6d-8eb8-8ea15d019f90\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"be05711b-cde1-43f9-852e-272aef1e95ef\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"M365CommunicationCompliance/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a413a9ff-720c-4822-98ef-2f37c2a21f4c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c070d4aa-15b1-402e-9a8c-518b75ef3c82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0b9d183-fff2-473a-ae81-c76780fee41a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a55dfd10-0864-46d9-a3cd-da5991a3e0e2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0dd2897-8950-44b5-af7f-fe6b88e63ba3\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsUpdateforBusinessCloudExtensions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7bf960f6-2cd9-443a-8046-5dbff9558365\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c2607019-4cc0-4b7e-a1c8-c28e73a83ee1\\\\\\\",\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:55:46", "Id": "d9642756-fcf0-48d4-a428-95fa25821134", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"3\",\"b\":\"\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c49c939c-a104-457c-8cd7-d760894e743c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b21a6b06-1988-436e-a07b-51ec6d9f52ad\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"cd275eb5-2674-4f06-a0ec-90315482df65\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6db1f1db-2b46-403f-be40-e39395f08dbb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ce5062ea-ce8b-4372-a2fc-cff48b560add\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a6520331-d7d4-4276-95f5-15c0933bc757\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"d7c3541a-3ed1-438c-bb72-957a30cb8eb6\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9aaf7827-d63c-4b61-89c3-182f06f82e5c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"db73abb5-f9a9-4b12-8dbd-355770d20bfb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8e0c0a52-6a6c-4d40-8370-dd62790dcd70\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"de949667-b9fe-44e7-b9ae-96520333194c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5e62787c-c316-451f-b873-1d05acd4d12c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e6d8465e-753b-456a-8ba1-e841ae571ba5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftEndpointDLP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"64bfac92-2b17-4482-b5e5-a0304429de3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e739bea5-7b43-4e3f-8a92-20fb7a6748cc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bed136c6-b799-4462-824d-fc045d3a9d25\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e79f51e6-a4c9-4321-8088-decabfc3da06\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsDefenderATP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"871d91ec-ec1a-452b-a83f-bd76c7d770ef\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e94f5a9d-5012-4107-a72b-606577cb5b56\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Modern-Workplace-Core-ITaas/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9a6eeb79-0b4b-4bf0-9808-39d99a2cd5a3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ee8abb1a-7c00-48db-95e1-265c2745b391\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"f6de4823-28fa-440b-b886-4783fa86ddba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f1564e02-9daf-49df-94c5-fbacac9670de\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c63d4d19-e8cb-460e-b37c-4d6c34603745\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f65de26a-7586-4e2d-9719-e6ba2c78d61a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf6f5520-59e3-4f82-974b-7dbbc4fd27c7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f89922ea-971d-49e4-bfd6-59d76adb59e4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"40b010bb-0b69-4654-ac5e-ba161433f4b4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f8a22b72-8227-4ac6-bdf1-e51dcdaa39b8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Deskless/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c7d2df8-86f0-4902-b2ed-a0458298f3b3\\\\\\\"}],\\\\\\\"NewValue\\\\\\\":[{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a5507169-ef95-4a37-8093-83db94a8cc1a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a1ace008-72f3-4ea0-8dac-33b3a23a2472\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"426015f6-326a-41d7-bae4-82254ed4578d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:55:46.4291055Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f8a22b72-8227-4ac6-bdf1-e51dcdaa39b8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Deskless/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c7d2df8-86f0-4902-b2ed-a0458298f3b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f65de26a-7586-4e2d-9719-e6ba2c78d61a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf6f5520-59e3-4f82-974b-7dbbc4fd27c7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ee8abb1a-7c00-48db-95e1-265c2745b391\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"f6de4823-28fa-440b-b886-4783fa86ddba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e94f5a9d-5012-4107-a72b-606577cb5b56\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Modern-Workplace-Core-ITaas/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9a6eeb79-0b4b-4bf0-9808-39d99a2cd5a3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e79f51e6-a4c9-4321-8088-decabfc3da06\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsDefenderATP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"871d91ec-ec1a-452b-a83f-bd76c7d770ef\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e6d8465e-753b-456a-8ba1-e841ae571ba5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftEndpointDLP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"64bfac92-2b17-4482-b5e5-a0304429de3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"db73abb5-f9a9-4b12-8dbd-355770d20bfb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8e0c0a52-6a6c-4d40-8370-dd62790dcd70\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ce5062ea-ce8b-4372-a2fc-cff48b560add\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a6520331-d7d4-4276-95f5-15c0933bc757\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"cd275eb5-2674-4f06-a0ec-90315482df65\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6db1f1db-2b46-403f-be40-e39395f08dbb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c49c939c-a104-457c-8cd7-d760894e743c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b21a6b06-1988-436e-a07b-51ec6d9f52ad\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0dd2897-8950-44b5-af7f-fe6b88e63ba3\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsUpdateforBusinessCloudExtensions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7bf960f6-2cd9-443a-8046-5dbff9558365\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c070d4aa-15b1-402e-9a8c-518b75ef3c82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"be05711b-cde1-43f9-852e-272aef1e95ef\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"M365CommunicationCompliance/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a413a9ff-720c-4822-98ef-2f37c2a21f4c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"baa8ba1c-b8d6-4888-9083-0c081fbb0e7a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bea4c11e-220a-4e6d-8eb8-8ea15d019f90\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ba289b1a-4798-491e-a84d-8a89b7a297a1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e212cbc7-0961-4c40-9825-01117710dcb1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b6604393-a3bd-47cf-b253-e6e8df62d3f1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"43de0ff5-c92c-492b-9116-175376d08c38\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b246d987-2ad4-4f05-a88e-83fd774338c0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9f431833-0334-42de-a7dc-70aa40db46db\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b110480e-8100-4062-a249-d83f17e8600c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MultiFactorService/NA001\\\\\\\",\\\\\\\"Cap\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:55:46", "Id": "d957c8bc-9c07-46fc-9d64-4c4fc2bfa52e", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"4\",\"b\":\"abilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8a256a2b-b617-496d-b51b-e76466e88db0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"adbf350a-69fc-4555-b8cd-ae15fe526691\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"ded3d325-1bdc-453e-8432-5bac26d7a014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"aa9e96b5-f0d7-4365-a72d-0455bc0fb033\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MIPExchangeSolutions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"cd31b152-6326-4d1b-ae1b-997b625182e6\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a744b8d6-1722-43b9-a160-e70185899ba0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c6042f5-6f01-4d67-b8c1-eb99d36eed3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a61bae3c-b11f-482e-8462-4ba97abcc71f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Windows/SDF\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"21b439ba-a0ca-424f-a6cc-52f954a5b111\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a2ef8d0a-c987-41bd-b836-1db72a7c227b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41781fb2-bc02-4b7c-bd55-b576c07bb09d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a234acf4-3a37-4c4a-81a5-0036757cce0e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"33c4f319-9bdd-48d6-9c4d-410b750a4a5a\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0df4d58-7374-4b6b-a87f-23b3184cc422\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6dc145d6-95dd-4191-b9c3-185575ee6f6b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0ba641c-2a64-436d-a8d3-e529abe19088\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerBI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"70d33638-9c74-4d01-bfd3-562de28bd4ba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9ff42d12-3bb8-4aa6-bbd7-23fb3971bc4c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"46129a58-a698-46f0-aa5b-17f6586297d9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9e507025-d62e-4a7f-9ab1-55936e76196b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3fb82609-8c27-4f7b-bd51-30634711ee67\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9055b9b6-ca02-4c07-8382-ef7586cd70b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Sway/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a23b959c-7ce8-4e57-9140-b90eb88a9e97\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"8b94b539-5ab2-4a55-b4db-7e5672ed55a9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4de31727-a228-4ec3-a5bf-8e45b5ca48cc\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"89dc8e14-e648-4d2e-a75f-a2aae3677148\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4a51bca5-1eff-43f5-878c-177680f191af\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"87787d52-8c6b-44b1-8125-0226a3493838\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"LearningAppServiceInTeams/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b76fb638-6ba6-402a-b9f9-83d28acb3d86\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"78e169e0-1454-4568-8dfd-e5fe3edc4d13\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"617b097b-4b93-4ede-83de-5f075bb5fb2f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"758ac54c-4359-4497-8074-980f45bf9381\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c57d4b6-3b23-47a5-9bc9-69f17b4947b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7065758c-18a7-4c4e-8e78-774ce2ad1097\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"199a5c09-e0ca-4e37-8f7c-b05d533e1ea2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6f38451f-2490-4a83-a681-dd6af213f6e1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"34c0d7a0-a70f-4668-9238-47f9fc208882\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b77f0c5-82bc-4af7-bbd5-c811004b982d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb87545-963c-4e0d-99df-69c6916d9eb0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b5f4303-b2f2-4bcc-be5a-06380b6d06bd\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41fcdd7d-4733-4863-9cf4-c65b83ce2df4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6aec41c1-6a8d-4679-b02b-aa3a193bbcf4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e26c2fcc-ab91-4a61-b35c-03cdc8dddf66\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"695f03a0-fa15-4b83-b4c5-312936e82361\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"07699545-9485-468e-95b6-2fca3738be01\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6632a0f5-bc7a-4c76-8ed9-0ba7b5f279bc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0898bdbb-73b0-471a-81e5-20f1fe4dd66e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"609eaebf-31a9-49f6-a079-b6b130d4b1f0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectWorkManagement/PROD_NA_Org_Ring_100\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b737dad2-2f6c-4c65-90e3-ca563267e8b9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5edcb9dd-550c-4fe7-a208-0e500b1c311c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9c0dab89-a30c-4117-86e7-97bda240acd2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"59956027-42b4-4311-b7f3-9de3c2f82f29\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftPrint/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"795f6fe0-cc4d-4773-b050-5dde4dc704c9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5960bdc8-5438-48cd-ab81-9c8815046666\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"65cc641f-cccd-4643-97e0-a17e3045e541\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5013f49d-b578-4a2d-9106-4dd025ef97b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5689bec4-755d-4753-8b61-40975025187c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4fd93da9-971e-45ae-a2dc-51154f0d174e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5dbe027f-2339-4123-9542-606e4d348a72\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4bd6d0f1-692a-4626-b03f-1d72feaa8d7c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Office365InsiderRisk/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d587c7a3-bda9-4f99-8776-9bcf59c84f75\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4b4b9b47-92ef-462c-aa50-afb777483ef4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e95bec33-7c88-4a70-8e19-b10bd9d0c014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"42a3adf0-6a2c-44df-b8bc-e435eb6aeb73\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d2d51368-76c9-4317-ada2-a12c004c432f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3f2de5ba-2779-4e4b-b720-7abc47df4af5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"28b0fa46-c39a-4188-89e2-58e979a6b014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3bdaaeba-01a4-4b77-ba29-54845686b4af\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0feaeb32-d00e-4d66-bd5a-43b5b83db82c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39e9d742-53f6-4acc-a844-4fa26478de82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b1188c4\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:55:46", "Id": "4020ec0f-0ebc-449a-90a8-e761679fe0b7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"5\",\"b\":\"c-1b36-4018-b48b-ee07604f6feb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39d44552-2bd6-4599-803e-3ccfd4b6502a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9d0c4ee5-e4a1-4625-ab39-d82b619b1a34\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"378cc2d1-7489-4372-b3c0-2179a6e8c72d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SCO/PROD_AMSUA0102_02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c1ec4a95-1f05-45b3-a911-aa3fa01094f5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2c310eeb-327e-4bfc-9235-69386c3a8ce1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c098270-9dd4-4350-9b30-ba4703f3b36b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2b092686-43fd-40d2-9f20-794390aa1c16\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c4801e8a-cb58-4c35-aca6-f2dcc106f287\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2a3c7121-f4fe-46d1-9b5f-e93c865bf6dc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"26a3d64a-198f-465b-a641-c3f8266f1ea5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4828c8ec-dc2e-4779-b502-87ac9ce28ab7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"23cab049-6eee-4aac-9595-f9b02af3373b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AzureAdvancedThreatAnalytics/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"14ab5db5-e6c4-4b20-b4bc-13e36fd2227f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"227b5826-9349-4504-97a3-81b1da2bbfbb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"531ee2f8-b1cb-453b-9c21-d2180d014ca5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"213dbe99-be20-4464-af87-54d0094fd6ce\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"eec0eb4f-6444-4f95-aba0-50c24d67f998\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1cfbcaa7-abeb-483d-a197-7e36348ed0f8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb0351d-3b08-4503-993d-383af8de41e3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1be931f9-9c0d-4148-a4ad-b61c221bc223\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftThreatProtection/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf28f719-7844-4079-9c78-c1307898e192\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"14faac42-bc6a-4c64-b309-6251c4cb09e2\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5136a095-5cf0-4aff-bec3-e84448b38ea5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0cd40d66-4fdd-4871-9af2-3e383b200b5d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"afa73018-811e-46e9-988f-f75d2b1b8430\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0a63ee3c-4c54-462d-a1c2-5766416685fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a82fbf69-b4d7-49f4-83a6-915b2cf354f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"072b9cb4-3176-43e6-882e-49b8836bf50b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7547a3fe-08ee-4ccb-b430-5077c5041653\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"023234e8-a87e-4ba4-8814-da5609cd4426\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"TeamspaceAPI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"57ff2da0-773e-42df-b2af-ffb7a2317929\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f89922ea-971d-49e4-bfd6-59d76adb59e4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"40b010bb-0b69-4654-ac5e-ba161433f4b4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f1564e02-9daf-49df-94c5-fbacac9670de\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c63d4d19-e8cb-460e-b37c-4d6c34603745\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e739bea5-7b43-4e3f-8a92-20fb7a6748cc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bed136c6-b799-4462-824d-fc045d3a9d25\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"de949667-b9fe-44e7-b9ae-96520333194c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5e62787c-c316-451f-b873-1d05acd4d12c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"d7c3541a-3ed1-438c-bb72-957a30cb8eb6\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9aaf7827-d63c-4b61-89c3-182f06f82e5c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c2607019-4cc0-4b7e-a1c8-c28e73a83ee1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0b9d183-fff2-473a-ae81-c76780fee41a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a55dfd10-0864-46d9-a3cd-da5991a3e0e2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b7f29e4e-3769-407f-b6b3-8dae5ee904fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3c53ea51-d578-46fa-a4c0-fd0a92809a60\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"990c2a47-fd1a-44d2-87e1-24c8c7897c48\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"159f4cd6-e380-449f-a816-af1a9ef76344\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7b60a390-3a7f-49da-99cc-69ba7be50496\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"54fc630f-5a40-48ee-8965-af0503c1386e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"765993af-af8f-4e10-9fed-a91a02c93a8f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0f9b09cb-62d1-4ff4-9129-43f4996f83f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5638cb0f-dcef-4ee1-977b-7f17c177c847\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c7699d2e-19aa-44de-8edf-1736da088ca1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"52cc074b-6308-4a8e-9c6c-5d3ac6175b6c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0683001c-0492-4d59-9515-d9a6426b5813\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"21765469-dcd6-4192-ab8a-e3f6bd760822\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b8afc642-032e-4de5-8c0a-507a7bba7e5d\\\\\\\"}]},{\\\\\\\"Name\\\\\\\":\\\\\\\"LicenseAssignmentDetail\\\\\\\",\\\\\\\"OldValue\\\\\\\":[{\\\\\\\"ReferenceObjectId\\\\\\\":\\\\\\\"57e4bd36-9722-4a4a-9729-7203d8e00b72\\\\\\\",\\\\\\\"Status\\\\\\\":0,\\\\\\\"AccountId\\\\\\\":\\\\\\\"bbad9541-eb53-4533-bcef-2b76182c3b75\\\\\\\",\\\\\\\"SkuId\\\\\\\":\\\\\\\"06ebc4ee-1bb5-47dd-8120-11324bc54e06\\\\\\\",\\\\\\\"Error\\\\\\\":0,\\\\\\\"StatusUpdateTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49.2645984Z\\\\\\\",\\\\\\\"DisabledPlans\\\\\\\":[\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"],\\\\\\\"EncodingVersion\\\\\\\":2}],\\\\\\\"NewValue\\\\\\\":[{\\\\\\\"ReferenceObjectId\\\\\\\":\\\\\\\"57e4bd36-9722-4a4a-9729-7203d8e00b72\\\\\\\",\\\\\\\"Status\\\\\\\":0,\\\\\\\"AccountId\\\\\\\":\\\\\\\"bbad9541-eb53-4533-bcef-2b76182c3b75\\\\\\\",\\\\\\\"SkuId\\\\\\\":\\\\\\\"06ebc4ee-1bb5-47dd-8120-11324bc54e06\\\\\\\",\\\\\\\"Error\\\\\\\":0,\\\\\\\"StatusUpdateTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:55:46.4081061Z\\\\\\\",\\\\\\\"DisabledPlans\\\\\\\":[],\\\\\\\"EncodingVersion\\\\\\\":2}]},{\\\\\\\"Name\\\\\\\":\\\\\\\"Included Updated Properties\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"AssignedLicense, AssignedPlan, LicenseAssignmentDetail\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"TargetId.UserType\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Member\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"ActorId.ServicePrincipalNames\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494-994a-533b57f91df7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"6\",\"b\":\"://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "26a03977-d614-4834-a679-c4266ef2a413", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"1\",\"b\":\"{\\\"targetUpdatedProperties\\\":\\\"[{\\\\\\\"Name\\\\\\\":\\\\\\\"AssignedLicense\\\\\\\",\\\\\\\"OldValue\\\\\\\":[\\\\\\\"[SkuName=SPE_E5, AccountId=bbad9541-eb53-4533-bcef-2b76182c3b75, SkuId=06ebc4ee-1bb5-47dd-8120-11324bc54e06, DisabledPlans=[]]\\\\\\\"],\\\\\\\"NewValue\\\\\\\":[\\\\\\\"[SkuName=SPE_E5, AccountId=bbad9541-eb53-4533-bcef-2b76182c3b75, SkuId=06ebc4ee-1bb5-47dd-8120-11324bc54e06, DisabledPlans=[M365_ADVANCED_AUDITING]]\\\\\\\"]},{\\\\\\\"Name\\\\\\\":\\\\\\\"AssignedPlan\\\\\\\",\\\\\\\"OldValue\\\\\\\":[{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"023234e8-a87e-4ba4-8814-da5609cd4426\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"TeamspaceAPI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"57ff2da0-773e-42df-b2af-ffb7a2317929\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"072b9cb4-3176-43e6-882e-49b8836bf50b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7547a3fe-08ee-4ccb-b430-5077c5041653\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0a63ee3c-4c54-462d-a1c2-5766416685fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a82fbf69-b4d7-49f4-83a6-915b2cf354f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0cd40d66-4fdd-4871-9af2-3e383b200b5d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"afa73018-811e-46e9-988f-f75d2b1b8430\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"14faac42-bc6a-4c64-b309-6251c4cb09e2\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5136a095-5cf0-4aff-bec3-e84448b38ea5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1be931f9-9c0d-4148-a4ad-b61c221bc223\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftThreatProtection/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf28f719-7844-4079-9c78-c1307898e192\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1cfbcaa7-abeb-483d-a197-7e36348ed0f8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb0351d-3b08-4503-993d-383af8de41e3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"213dbe99-be20-4464-af87-54d0094fd6ce\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"eec0eb4f-6444-4f95-aba0-50c24d67f998\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"21765469-dcd6-4192-ab8a-e3f6bd760822\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b8afc642-032e-4de5-8c0a-507a7bba7e5d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"227b5826-9349-4504-97a3-81b1da2bbfbb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"531ee2f8-b1cb-453b-9c21-d2180d014ca5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"23cab049-6eee-4aac-9595-f9b02af3373b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AzureAdvancedThreatAnalytics/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"14ab5db5-e6c4-4b20-b4bc-13e36fd2227f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"26a3d64a-198f-465b-a641-c3f8266f1ea5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4828c8ec-dc2e-4779-b502-87ac9ce28ab7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2a3c7121-f4fe-46d1-9b5f-e93c865bf6dc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2b092686-43fd-40d2-9f20-794390aa1c16\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c4801e8a-cb58-4c35-aca6-f2dcc106f287\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2c310eeb-327e-4bfc-9235-69386c3a8ce1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c098270-9dd4-4350-9b30-ba4703f3b36b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"378cc2d1-7489-4372-b3c0-2179a6e8c72d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SCO/PROD_AMSUA0102_02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c1ec4a95-1f05-45b3-a911-aa3fa01094f5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39d44552-2bd6-4599-803e-3ccfd4b6502a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9d0c4ee5-e4a1-4625-ab39-d82b619b1a34\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39e9d742-53f6-4acc-a844-4fa26478de82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b1188c4c-1b36-4018-b48b-ee07604f6feb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3bdaaeba-01a4-4b77-ba29-54845686b4af\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0feaeb32-d00e-4d66-bd5a-43b5b83db82c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3f2de5ba-2779-4e4b-b720-7abc47df4af5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"28b0fa46-c39a-4188-89e2-58e979a6b014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"426015f6-326a-41d7-bae4-82254ed4578d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"42a3adf0-6a2c-44df-b8bc-e435eb6aeb73\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d2d51368-76c9-4317-ada2-a12c004c432f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4b4b9b47-92ef-462c-aa50-afb777483ef4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e95bec33-7c88-4a70-8e19-b10bd9d0c014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4bd6d0f1-692a-4626-b03f-1d72feaa8d7c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Office365InsiderRisk/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d587c7a3-bda9-4f99-8776-9bcf59c84f75\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4fd93da9-971e-45ae-a2dc-51154f0d174e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5dbe027f-2339-4123-9542-606e4d348a72\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5013f49d-b578-4a2d-9106-4dd025ef97b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5689bec4-755d-4753-8b61-40975025187c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"52cc074b-6308-4a8e-9c6c-5d3ac6175b6c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0683001c-0492-4d59-9515-d9a6426b5813\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5638cb0f-dcef-4ee1-977b-7f17c177c847\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c7699d2e-19aa-44de-8edf-1736da088ca1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5960bdc8-5438-48cd-ab81-9c8815046666\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"65cc641f-cccd-4643-97e0-a17e3045e541\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"59956027-42b4-4311-b7f3-9de3c2f82f29\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftPrint/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"795f6fe0-cc4d-4773-b050-5dde4dc704c9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5edcb9dd-550c-4fe7-a208-0e500b1c311c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9c0dab89-a30c-4117-86e7-97bda240acd2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"609eaebf-31a9-49f6-a079-b6b130d4b1f0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectWorkManagement/PROD_NA_Org_Ring_100\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b737dad2-2f6c-4c65-90e3-ca563267e8b9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6632a0f5-bc7a-4c76-8ed9-0ba7b5f279bc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0898bdbb-73b0-471a-81e5-20f1fe4dd66e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"695f03a0-fa15-4b83-b4c5-312936e82361\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\"\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "a509b74d-e266-4484-99ca-0ee691171647", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"2\",\"b\":\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"07699545-9485-468e-95b6-2fca3738be01\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6aec41c1-6a8d-4679-b02b-aa3a193bbcf4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e26c2fcc-ab91-4a61-b35c-03cdc8dddf66\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b5f4303-b2f2-4bcc-be5a-06380b6d06bd\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41fcdd7d-4733-4863-9cf4-c65b83ce2df4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b77f0c5-82bc-4af7-bbd5-c811004b982d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb87545-963c-4e0d-99df-69c6916d9eb0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6f38451f-2490-4a83-a681-dd6af213f6e1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"34c0d7a0-a70f-4668-9238-47f9fc208882\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7065758c-18a7-4c4e-8e78-774ce2ad1097\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"199a5c09-e0ca-4e37-8f7c-b05d533e1ea2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"758ac54c-4359-4497-8074-980f45bf9381\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c57d4b6-3b23-47a5-9bc9-69f17b4947b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"765993af-af8f-4e10-9fed-a91a02c93a8f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0f9b09cb-62d1-4ff4-9129-43f4996f83f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"78e169e0-1454-4568-8dfd-e5fe3edc4d13\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"617b097b-4b93-4ede-83de-5f075bb5fb2f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7b60a390-3a7f-49da-99cc-69ba7be50496\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"54fc630f-5a40-48ee-8965-af0503c1386e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"87787d52-8c6b-44b1-8125-0226a3493838\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"LearningAppServiceInTeams/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b76fb638-6ba6-402a-b9f9-83d28acb3d86\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"89dc8e14-e648-4d2e-a75f-a2aae3677148\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4a51bca5-1eff-43f5-878c-177680f191af\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"8b94b539-5ab2-4a55-b4db-7e5672ed55a9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4de31727-a228-4ec3-a5bf-8e45b5ca48cc\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9055b9b6-ca02-4c07-8382-ef7586cd70b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Sway/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a23b959c-7ce8-4e57-9140-b90eb88a9e97\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"990c2a47-fd1a-44d2-87e1-24c8c7897c48\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"159f4cd6-e380-449f-a816-af1a9ef76344\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9e507025-d62e-4a7f-9ab1-55936e76196b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3fb82609-8c27-4f7b-bd51-30634711ee67\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9ff42d12-3bb8-4aa6-bbd7-23fb3971bc4c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"46129a58-a698-46f0-aa5b-17f6586297d9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0ba641c-2a64-436d-a8d3-e529abe19088\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerBI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"70d33638-9c74-4d01-bfd3-562de28bd4ba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0df4d58-7374-4b6b-a87f-23b3184cc422\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6dc145d6-95dd-4191-b9c3-185575ee6f6b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a234acf4-3a37-4c4a-81a5-0036757cce0e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"33c4f319-9bdd-48d6-9c4d-410b750a4a5a\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a2ef8d0a-c987-41bd-b836-1db72a7c227b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41781fb2-bc02-4b7c-bd55-b576c07bb09d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a61bae3c-b11f-482e-8462-4ba97abcc71f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Windows/SDF\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"21b439ba-a0ca-424f-a6cc-52f954a5b111\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a744b8d6-1722-43b9-a160-e70185899ba0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c6042f5-6f01-4d67-b8c1-eb99d36eed3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"aa9e96b5-f0d7-4365-a72d-0455bc0fb033\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MIPExchangeSolutions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"cd31b152-6326-4d1b-ae1b-997b625182e6\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"adbf350a-69fc-4555-b8cd-ae15fe526691\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"ded3d325-1bdc-453e-8432-5bac26d7a014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b110480e-8100-4062-a249-d83f17e8600c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MultiFactorService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8a256a2b-b617-496d-b51b-e76466e88db0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b246d987-2ad4-4f05-a88e-83fd774338c0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9f431833-0334-42de-a7dc-70aa40db46db\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b6604393-a3bd-47cf-b253-e6e8df62d3f1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"43de0ff5-c92c-492b-9116-175376d08c38\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b7f29e4e-3769-407f-b6b3-8dae5ee904fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3c53ea51-d578-46fa-a4c0-fd0a92809a60\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ba289b1a-4798-491e-a84d-8a89b7a297a1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e212cbc7-0961-4c40-9825-01117710dcb1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"baa8ba1c-b8d6-4888-9083-0c081fbb0e7a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bea4c11e-220a-4e6d-8eb8-8ea15d019f90\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"be05711b-cde1-43f9-852e-272aef1e95ef\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"M365CommunicationCompliance/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a413a9ff-720c-4822-98ef-2f37c2a21f4c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c070d4aa-15b1-402e-9a8c-518b75ef3c82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0b9d183-fff2-473a-ae81-c76780fee41a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a55dfd10-0864-46d9-a3cd-da5991a3e0e2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0dd2897-8950-44b5-af7f-fe6b88e63ba3\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsUpdateforBusinessCloudExtensions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7bf960f6-2cd9-443a-8046-5dbff9558365\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c2607019-4cc0-4b7e-a1c8-c28e73a83ee1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c49c939c-a104-457c-8cd7-d760894e743c\\\\\\\",\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "ec8e2a6d-bc71-4e31-91f3-f46dd18f3411", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"3\",\"b\":\"\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b21a6b06-1988-436e-a07b-51ec6d9f52ad\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"cd275eb5-2674-4f06-a0ec-90315482df65\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6db1f1db-2b46-403f-be40-e39395f08dbb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ce5062ea-ce8b-4372-a2fc-cff48b560add\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a6520331-d7d4-4276-95f5-15c0933bc757\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"d7c3541a-3ed1-438c-bb72-957a30cb8eb6\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9aaf7827-d63c-4b61-89c3-182f06f82e5c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"db73abb5-f9a9-4b12-8dbd-355770d20bfb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8e0c0a52-6a6c-4d40-8370-dd62790dcd70\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"de949667-b9fe-44e7-b9ae-96520333194c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5e62787c-c316-451f-b873-1d05acd4d12c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e6d8465e-753b-456a-8ba1-e841ae571ba5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftEndpointDLP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"64bfac92-2b17-4482-b5e5-a0304429de3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e739bea5-7b43-4e3f-8a92-20fb7a6748cc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bed136c6-b799-4462-824d-fc045d3a9d25\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e79f51e6-a4c9-4321-8088-decabfc3da06\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsDefenderATP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"871d91ec-ec1a-452b-a83f-bd76c7d770ef\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e94f5a9d-5012-4107-a72b-606577cb5b56\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Modern-Workplace-Core-ITaas/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9a6eeb79-0b4b-4bf0-9808-39d99a2cd5a3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ee8abb1a-7c00-48db-95e1-265c2745b391\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"f6de4823-28fa-440b-b886-4783fa86ddba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f1564e02-9daf-49df-94c5-fbacac9670de\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c63d4d19-e8cb-460e-b37c-4d6c34603745\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f65de26a-7586-4e2d-9719-e6ba2c78d61a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf6f5520-59e3-4f82-974b-7dbbc4fd27c7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f89922ea-971d-49e4-bfd6-59d76adb59e4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"40b010bb-0b69-4654-ac5e-ba161433f4b4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f8a22b72-8227-4ac6-bdf1-e51dcdaa39b8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Deskless/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c7d2df8-86f0-4902-b2ed-a0458298f3b3\\\\\\\"}],\\\\\\\"NewValue\\\\\\\":[{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f8a22b72-8227-4ac6-bdf1-e51dcdaa39b8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Deskless/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c7d2df8-86f0-4902-b2ed-a0458298f3b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f65de26a-7586-4e2d-9719-e6ba2c78d61a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf6f5520-59e3-4f82-974b-7dbbc4fd27c7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ee8abb1a-7c00-48db-95e1-265c2745b391\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"f6de4823-28fa-440b-b886-4783fa86ddba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e94f5a9d-5012-4107-a72b-606577cb5b56\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Modern-Workplace-Core-ITaas/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9a6eeb79-0b4b-4bf0-9808-39d99a2cd5a3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e79f51e6-a4c9-4321-8088-decabfc3da06\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsDefenderATP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"871d91ec-ec1a-452b-a83f-bd76c7d770ef\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e6d8465e-753b-456a-8ba1-e841ae571ba5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftEndpointDLP/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"64bfac92-2b17-4482-b5e5-a0304429de3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"db73abb5-f9a9-4b12-8dbd-355770d20bfb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8e0c0a52-6a6c-4d40-8370-dd62790dcd70\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ce5062ea-ce8b-4372-a2fc-cff48b560add\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a6520331-d7d4-4276-95f5-15c0933bc757\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"cd275eb5-2674-4f06-a0ec-90315482df65\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6db1f1db-2b46-403f-be40-e39395f08dbb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c49c939c-a104-457c-8cd7-d760894e743c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b21a6b06-1988-436e-a07b-51ec6d9f52ad\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0dd2897-8950-44b5-af7f-fe6b88e63ba3\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WindowsUpdateforBusinessCloudExtensions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7bf960f6-2cd9-443a-8046-5dbff9558365\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c070d4aa-15b1-402e-9a8c-518b75ef3c82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"be05711b-cde1-43f9-852e-272aef1e95ef\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"M365CommunicationCompliance/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a413a9ff-720c-4822-98ef-2f37c2a21f4c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"baa8ba1c-b8d6-4888-9083-0c081fbb0e7a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bea4c11e-220a-4e6d-8eb8-8ea15d019f90\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"ba289b1a-4798-491e-a84d-8a89b7a297a1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e212cbc7-0961-4c40-9825-01117710dcb1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b6604393-a3bd-47cf-b253-e6e8df62d3f1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"43de0ff5-c92c-492b-9116-175376d08c38\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b246d987-2ad4-4f05-a88e-83fd774338c0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9f431833-0334-42de-a7dc-70aa40db46db\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b110480e-8100-4062-a249-d83f17e8600c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MultiFactorService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8a256a2b-b617-496d-b51b-e76466e88db0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"adbf350a-69fc-4555-b8cd-ae15fe526691\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"ded3d325-1bdc-453e-8432-5bac26d7a014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"aa9e96b5-f0d7-4365-a72d-0455bc0fb033\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MIPExchangeSolutions/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"cd31b152-6326-4d1b-ae1b-997b625182e6\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a744b8d6-1722-43b9-a160-e70185899ba0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatu\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "f2606fbb-0158-42cc-886a-898484d37b11", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"4\",\"b\":\"s\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c6042f5-6f01-4d67-b8c1-eb99d36eed3e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a61bae3c-b11f-482e-8462-4ba97abcc71f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Windows/SDF\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"21b439ba-a0ca-424f-a6cc-52f954a5b111\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a2ef8d0a-c987-41bd-b836-1db72a7c227b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41781fb2-bc02-4b7c-bd55-b576c07bb09d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a234acf4-3a37-4c4a-81a5-0036757cce0e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"33c4f319-9bdd-48d6-9c4d-410b750a4a5a\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0df4d58-7374-4b6b-a87f-23b3184cc422\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6dc145d6-95dd-4191-b9c3-185575ee6f6b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a0ba641c-2a64-436d-a8d3-e529abe19088\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerBI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"70d33638-9c74-4d01-bfd3-562de28bd4ba\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9ff42d12-3bb8-4aa6-bbd7-23fb3971bc4c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"46129a58-a698-46f0-aa5b-17f6586297d9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9e507025-d62e-4a7f-9ab1-55936e76196b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3fb82609-8c27-4f7b-bd51-30634711ee67\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"9055b9b6-ca02-4c07-8382-ef7586cd70b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Sway/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a23b959c-7ce8-4e57-9140-b90eb88a9e97\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"8b94b539-5ab2-4a55-b4db-7e5672ed55a9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4de31727-a228-4ec3-a5bf-8e45b5ca48cc\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"89dc8e14-e648-4d2e-a75f-a2aae3677148\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4a51bca5-1eff-43f5-878c-177680f191af\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"87787d52-8c6b-44b1-8125-0226a3493838\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"LearningAppServiceInTeams/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b76fb638-6ba6-402a-b9f9-83d28acb3d86\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"78e169e0-1454-4568-8dfd-e5fe3edc4d13\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"617b097b-4b93-4ede-83de-5f075bb5fb2f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"758ac54c-4359-4497-8074-980f45bf9381\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"6c57d4b6-3b23-47a5-9bc9-69f17b4947b3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7065758c-18a7-4c4e-8e78-774ce2ad1097\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"199a5c09-e0ca-4e37-8f7c-b05d533e1ea2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6f38451f-2490-4a83-a681-dd6af213f6e1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"34c0d7a0-a70f-4668-9238-47f9fc208882\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b77f0c5-82bc-4af7-bbd5-c811004b982d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb87545-963c-4e0d-99df-69c6916d9eb0\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6b5f4303-b2f2-4bcc-be5a-06380b6d06bd\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"41fcdd7d-4733-4863-9cf4-c65b83ce2df4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6aec41c1-6a8d-4679-b02b-aa3a193bbcf4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e26c2fcc-ab91-4a61-b35c-03cdc8dddf66\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"695f03a0-fa15-4b83-b4c5-312936e82361\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"07699545-9485-468e-95b6-2fca3738be01\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"6632a0f5-bc7a-4c76-8ed9-0ba7b5f279bc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0898bdbb-73b0-471a-81e5-20f1fe4dd66e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"609eaebf-31a9-49f6-a079-b6b130d4b1f0\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectWorkManagement/PROD_NA_Org_Ring_100\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b737dad2-2f6c-4c65-90e3-ca563267e8b9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5edcb9dd-550c-4fe7-a208-0e500b1c311c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9c0dab89-a30c-4117-86e7-97bda240acd2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"59956027-42b4-4311-b7f3-9de3c2f82f29\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftPrint/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"795f6fe0-cc4d-4773-b050-5dde4dc704c9\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5960bdc8-5438-48cd-ab81-9c8815046666\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"65cc641f-cccd-4643-97e0-a17e3045e541\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5013f49d-b578-4a2d-9106-4dd025ef97b9\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"RMSOnline/NA\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5689bec4-755d-4753-8b61-40975025187c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4fd93da9-971e-45ae-a2dc-51154f0d174e\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5dbe027f-2339-4123-9542-606e4d348a72\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4bd6d0f1-692a-4626-b03f-1d72feaa8d7c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Office365InsiderRisk/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d587c7a3-bda9-4f99-8776-9bcf59c84f75\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"4b4b9b47-92ef-462c-aa50-afb777483ef4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"e95bec33-7c88-4a70-8e19-b10bd9d0c014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"42a3adf0-6a2c-44df-b8bc-e435eb6aeb73\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"d2d51368-76c9-4317-ada2-a12c004c432f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"426015f6-326a-41d7-bae4-82254ed4578d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49.3105955Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3f2de5ba-2779-4e4b-b720-7abc47df4af5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"28b0fa46-c39a-4188-89e2-58e979a6b014\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"3bdaaeba-01a4-4b77-ba29-54845686b4af\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0feaeb32-d00e-4d66-bd5a-43b5b83db82c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39e9d742-53f6-4acc-a844-4fa26478de82\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b1188c4c-1b36-4018-b48b-ee07604f6feb\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"39d44552-2bd6-4599-803e-3ccfd4b6502a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9d0c4ee5-e4a1-4625-ab39-d82b619b1a34\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"378cc2d1-7489-4372-b3c0-2179a6e8c72d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SCO/PROD_AMSUA0102_02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c1ec4a\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "31426b6d-72b9-487a-a428-6c4e4108b87e", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"5\",\"b\":\"95-1f05-45b3-a911-aa3fa01094f5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2c310eeb-327e-4bfc-9235-69386c3a8ce1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"Adallom/NA002\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"8c098270-9dd4-4350-9b30-ba4703f3b36b\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2b092686-43fd-40d2-9f20-794390aa1c16\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c4801e8a-cb58-4c35-aca6-f2dcc106f287\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"2a3c7121-f4fe-46d1-9b5f-e93c865bf6dc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"26a3d64a-198f-465b-a641-c3f8266f1ea5\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftCommunicationsOnline/NOAM-2A-S2\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"4828c8ec-dc2e-4779-b502-87ac9ce28ab7\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"23cab049-6eee-4aac-9595-f9b02af3373b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AzureAdvancedThreatAnalytics/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"14ab5db5-e6c4-4b20-b4bc-13e36fd2227f\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"227b5826-9349-4504-97a3-81b1da2bbfbb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"531ee2f8-b1cb-453b-9c21-d2180d014ca5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"213dbe99-be20-4464-af87-54d0094fd6ce\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"AADPremiumService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"eec0eb4f-6444-4f95-aba0-50c24d67f998\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1cfbcaa7-abeb-483d-a197-7e36348ed0f8\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"efb0351d-3b08-4503-993d-383af8de41e3\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"1be931f9-9c0d-4148-a4ad-b61c221bc223\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftThreatProtection/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bf28f719-7844-4079-9c78-c1307898e192\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"14faac42-bc6a-4c64-b309-6251c4cb09e2\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5136a095-5cf0-4aff-bec3-e84448b38ea5\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0cd40d66-4fdd-4871-9af2-3e383b200b5d\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"afa73018-811e-46e9-988f-f75d2b1b8430\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"0a63ee3c-4c54-462d-a1c2-5766416685fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a82fbf69-b4d7-49f4-83a6-915b2cf354f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"072b9cb4-3176-43e6-882e-49b8836bf50b\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"YammerEnterprise/NA008\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"7547a3fe-08ee-4ccb-b430-5077c5041653\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"023234e8-a87e-4ba4-8814-da5609cd4426\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"TeamspaceAPI/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:38Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"57ff2da0-773e-42df-b2af-ffb7a2317929\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f89922ea-971d-49e4-bfd6-59d76adb59e4\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"40b010bb-0b69-4654-ac5e-ba161433f4b4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"f1564e02-9daf-49df-94c5-fbacac9670de\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftOffice/NorthAmerica1\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c63d4d19-e8cb-460e-b37c-4d6c34603745\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"e739bea5-7b43-4e3f-8a92-20fb7a6748cc\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"CRM/NA02\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"bed136c6-b799-4462-824d-fc045d3a9d25\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"de949667-b9fe-44e7-b9ae-96520333194c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"To-Do/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"5e62787c-c316-451f-b873-1d05acd4d12c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"d7c3541a-3ed1-438c-bb72-957a30cb8eb6\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"exchange/namprd18-002-01\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"9aaf7827-d63c-4b61-89c3-182f06f82e5c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c2607019-4cc0-4b7e-a1c8-c28e73a83ee1\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"PowerAppsService/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"c0b9d183-fff2-473a-ae81-c76780fee41a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProjectProgramsAndPortfolios/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a55dfd10-0864-46d9-a3cd-da5991a3e0e2\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"b7f29e4e-3769-407f-b6b3-8dae5ee904fb\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftStream/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"3c53ea51-d578-46fa-a4c0-fd0a92809a60\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"990c2a47-fd1a-44d2-87e1-24c8c7897c48\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"OfficeForms/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"159f4cd6-e380-449f-a816-af1a9ef76344\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"7b60a390-3a7f-49da-99cc-69ba7be50496\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"MicrosoftKaizala/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"54fc630f-5a40-48ee-8965-af0503c1386e\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"765993af-af8f-4e10-9fed-a91a02c93a8f\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ProcessSimple/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0f9b09cb-62d1-4ff4-9129-43f4996f83f4\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"5638cb0f-dcef-4ee1-977b-7f17c177c847\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"c7699d2e-19aa-44de-8edf-1736da088ca1\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"52cc074b-6308-4a8e-9c6c-5d3ac6175b6c\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"ccibotsprod/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"0683001c-0492-4d59-9515-d9a6426b5813\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"21765469-dcd6-4192-ab8a-e3f6bd760822\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"WhiteboardServices/NA001\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":3,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:41:21Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"b8afc642-032e-4de5-8c0a-507a7bba7e5d\\\\\\\"},{\\\\\\\"SubscribedPlanId\\\\\\\":\\\\\\\"a5507169-ef95-4a37-8093-83db94a8cc1a\\\\\\\",\\\\\\\"ServiceInstance\\\\\\\":\\\\\\\"SharePoint/US-105-0015\\\\\\\",\\\\\\\"CapabilityStatus\\\\\\\":0,\\\\\\\"AssignedTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49.3105955Z\\\\\\\",\\\\\\\"InitialState\\\\\\\":null,\\\\\\\"Capability\\\\\\\":null,\\\\\\\"ServicePlanId\\\\\\\":\\\\\\\"a1ace008-72f3-4ea0-8dac-33b3a23a2472\\\\\\\"}]},{\\\\\\\"Name\\\\\\\":\\\\\\\"LicenseAssignmentDetail\\\\\\\",\\\\\\\"OldValue\\\\\\\":[{\\\\\\\"ReferenceObjectId\\\\\\\":\\\\\\\"57e4bd36-9722-4a4a-9729-7203d8e00b72\\\\\\\",\\\\\\\"Status\\\\\\\":0,\\\\\\\"AccountId\\\\\\\":\\\\\\\"bbad9541-eb53-4533-bcef-2b76182c3b75\\\\\\\",\\\\\\\"SkuId\\\\\\\":\\\\\\\"06ebc4ee-1bb5-47dd-8120-11324bc54e06\\\\\\\",\\\\\\\"Error\\\\\\\":0,\\\\\\\"StatusUpdateTimestamp\\\\\\\":\\\\\\\"2023-07-27T17:47:56.8660587Z\\\\\\\",\\\\\\\"DisabledPlans\\\\\\\":[],\\\\\\\"EncodingVersion\\\\\\\":2}],\\\\\\\"NewValue\\\\\\\":[{\\\\\\\"ReferenceObjectId\\\\\\\":\\\\\\\"57e4bd36-9722-4a4a-9729-7203d8e00b72\\\\\\\",\\\\\\\"Status\\\\\\\":0,\\\\\\\"AccountId\\\\\\\":\\\\\\\"bbad9541-eb53-4533-bcef-2b76182c3b75\\\\\\\",\\\\\\\"SkuId\\\\\\\":\\\\\\\"06ebc4ee-1bb5-47dd-8120-11324bc54e06\\\\\\\",\\\\\\\"Error\\\\\\\":0,\\\\\\\"StatusUpdateTimestamp\\\\\\\":\\\\\\\"2023-09-11T15:49:49.2645984Z\\\\\\\",\\\\\\\"DisabledPlans\\\\\\\":[\\\\\\\"2f442157-a11c-46b9-ae5b-6e39ff4e5849\\\\\\\"],\\\\\\\"EncodingVersion\\\\\\\":2}]},{\\\\\\\"Name\\\\\\\":\\\\\\\"Included Updated Properties\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"AssignedLicense, AssignedPlan, LicenseAssignmentDetail\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"TargetId.UserType\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Member\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"ActorId.ServicePrincipalNames\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}
{"CreationTime": "2023-09-11T15:49:49", "Id": "5070da56-a164-4f0e-8753-68203b87e486", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"0988a54d-67bd-410c-8441-4501912024b6\",\"seq\":\"6\",\"b\":\"ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "ccf9fe69-b757-4436-a9d3-4972de1ada4e", "IntraSystemId": "3877db8b-5daa-4f65-b62b-72a9b904aea5", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}