Add an example to the docs that highlights this search pattern: ``` | jmespath output=NewDisplayName "ExtendedProperties[?Name=='targetUpdatedProperties'].Value | from_string(@[0]) | [?ends_with(Name,'.DisplayName')].NewValue" ``` Thanks to @jpapasadora MS O365 Management. Search something like: `sourcetype=ms:o365:management member (group OR role)`