Thank you for your reply. I understand that my criteria were incorrect.
I want to check if there have been any operations that changed the user or group that can manage the service principal. Is it correct to search using the conditions you suggested, `service_name = accountsAccessControl, action_name = updateRuleSet`?
Also, what other operations would be included in a search using these conditions?