Azure Sentinel: Performing Additional Security Monitoring of High-Value Accounts

Ciyaresh - Thanks for the question.  I probably need a bit more information, but let me see if I can help first.  You can create a list from any table source using this type of method and then simply reference the variable assigned:

let interestingGroups = IdentityInfo

| project GroupMembership
| mv-expand GroupMembership

| extend GroupMembership = tostring(GroupMembership)
| summarize make_set(GroupMembership);

AuditLogs
| where Category =~ "GroupManagement" and OperationName =~ "Update group"
| project TimeGenerated, OperationName, Category, InitiatedBy, TargetResources
| mv-expand TargetResources
| where TargetResources.type =~ "Group"
| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))
| extend GroupName = tostring(TargetResources.displayName)
| where GroupName in~ (interestingGroups) // <-- This is variable that contains the list of groups for IdentityInfo.