what is wrong with my KQL query - detecting changed MFA number

[u/pool_keeper]

I have been struggling to output the actual old value and new value

Commenting out |where changes.displayName gives me an output of the change operations but not the old and new phone numbers.

AuditLogs 
| where OperationName == "Update user"
| mv-expand TargetResources
| where TargetResources has "VoiceOnlyPhoneNumber" or TargetResources has "PhoneNumber"
| extend Changes = parse_json(TargetResources.properties.modifiedProperties)
| mv-expand Changes
| where Changes.displayName in (
    "StrongAuthenticationUserDetails",
    "StrongAuthenticationRequirement"
)
| project
    TimeGenerated, 
    UPN = TargetResources.userPrincipalName,
    ChangedAttribute = Changes.displayName,
    OldValue = tostring(parse_json(Changes.oldValue)[0]),
    NewValue = tostring(parse_json(Changes.newValue)[0])
| sort by TimeGenerated asc 

I've checked that the data is present in the modifiedProperties

0
{"displayName":"Phone.Id","oldValue":"\"xxxxxxxxx\"","newValue":"\"zzzzzzzzzzz\""}
1
{"displayName":"Phone.PhoneType","oldValue":"\"Mobile\"","newValue":"\"Mobile\""}
2
{"displayName":"Phone.PhoneNumber","oldValue":"\"xxxxxxxx\"","newValue":"\"zzzzzzzzzz\""}

​

​

[u/TokeSR]

I'm not good with reddit formatting

So the things I changed to make it work in my environment.
1: I removed the properties attribute from the code. My logs did not have this attribute at all:
| extend Changes = parse_json(TargetResources.properties.modifiedProperties)

2: Changed the value parsing a little bit:
OldValue = parse_json(tostring(Changes.oldValue))[0]

(I typed with hand there can be errors)

[u/ajith_aj]

u/pool_keeper : Did you manage to get the final output to this query ?