How to query/report on Defender Portal admin changes to policies

Hi there,

If someone makes a change to, say, the Cloud apps policies, I should be able run an Audit report to see that change.

I tried running an Audit search (from the Audit menu/blade in the Defender portal), but it didn't return any results related to the policy change.

Does anyone here have an example of how to test the Defender portal audit logs?

Pretty sure these logs don't go through the Sentinel data connector so I'd like to know how to audit changes in the Defender portal.

Thanks!