Hunting for MFA manipulations in Entra ID tenants using KQL

Thanks for the suggestion. I attempted to join the tables as you outlined but was unable to extract the recordid. I am continuing to work on this.

On a related note, I find it interesting that an account's MFA settings can be modified without generating an alert for the user.