@merill.net Do you know of a way to correlate Entra audit operation
names (ie. "add service principal") to the permission that is
required?

Looking to correlate these to know which privileges an account is
using for the audit log operation