ESCU - Azure AD * Role Assigned - Rule - Not always by "initiatedBy.user.userPrincipalName"

[IvarNy]

When PIM roles are used for adding users to Roles the initiatedBy.user.userPrincipalName is not filled.

So instead of "| rename initiatedBy.user.userPrincipalName as initiatedBy" it may be better with:

| eval initiatedBy = coalesce('initiatedBy.user.userPrincipalName', 'initiatedBy.app.displayName')
so these searches will work in both cases?

[mvelazc0]

thanks for the feedback @IvarNy. I'll take care of this