Audit logs for a change made in SP Admin Center didn't show a change from modern auth to legacy auth

I was performing an audit in Microsoft Purview,

https://compliance.microsoft.com/auditlogsearch?viewid=Async%20Search

 

I did a New Search (preview) and I selected a person to "monitor" who was granted access to heightened security.  I was monitoring to see what they might be doing and or if they were making changes.  I did the audit on the account and for the date as "current" as possible.  I ran the search, and it didn't show me that they changed from modern authentication to legacy authentication.