Finetuning Sentinel alert for user added to Azure Active Directory Privileged Groups

I know this is old but did you ever find anything for this, I have the exact same issue, the below didn't work, I did edit the query to this, which doesn't pick up activations but also doesn't pick up when new roles are added :

let OperationList = dynamic(["Add member to role", "Add member to role in PIM requested (permanent)"]);

let PrivilegedGroups = dynamic(["UserAccountAdmins", "PrivilegedRoleAdmins", "TenantAdmins"]);

AuditLogs

| where Category =~ "RoleManagement"

| where OperationName in~ (OperationList)

| mv-apply TargetResource = TargetResources on

  (

      where TargetResource.type =~ "User"

      | extend TargetUserPrincipalName = tostring(TargetResource.userPrincipalName),

               modProps = TargetResource.modifiedProperties

  )

| mv-apply Property = modProps on

  (

      where Property.displayName =~ "Role.WellKnownObjectName"

      | extend DisplayName = trim('"',tostring(Property.displayName)),

               GroupName = trim('"',tostring(Property.newValue))

  )

| extend InitiatingAppId = tostring(InitiatedBy.app.appId)

| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)

| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)

| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.servicePrincipalName)

| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)

| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)

| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))        

| extend InitiatingUserRoles = InitiatedBy.user.roles

| where GroupName in~ (PrivilegedGroups)

| where InitiatingAppName != "MS-PIM"

| project TimeGenerated, AADOperationType, Category, OperationName, AADTenantId, InitiatingUserPrincipalName, InitiatingAadUserId, InitiatingAppName, InitiatingAppId, InitiatingAppServicePrincipalId, InitiatingIpAddress, InitiatingUserRoles, DisplayName, GroupName, TargetUserPrincipalName

| extend InitiatedByName = tostring(split(InitiatingUserPrincipalName,'@',0)[0]), InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName,'@',1)[0])

| extend TargetName = tostring(split(TargetUserPrincipalName,'@',0)[0]), TargetUPNSuffix = tostring(split(TargetUserPrincipalName,'@',1)[0])