How to detect access denied/unauthorized activity logs in Azure? - azure

Question

My objective is to detect actions performed by users that resulted in an access denied or unauthorized error using activity logs.
To detect error I use the field "resultType" field. When it is "Failure", I know that this is an error record. I want to go one step further and filter those which are "access denied" or "unauthorized" error records.
I have considered following fields so far as potential candidates for the same, however haven't found any relevant information in them.
resultDescription
properties.statusCode
Following is the sample schema of the activity log we get on our end. The schema is such because we stream our activity log to a storage account(https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema#schema-from-storage-account-and-event-hubs)
When streaming the Azure Activity log to a storage account or event hub, the data >?>follows the resource log schema.
{
"callerIpAddress" : "0.0.0.0",
"resourceGroup" : "group",
"resourceId" : "dummy",
"level" : "Information",
"production" : false,
"operationName" : "MICROSOFT.WEB/DUMMY",
"ingestTime" : "time",
"resultSignature" : "Succeeded.OK",
"accountId" : "dummyId",
"identity" : {
"authorization" : {
"evidence" : {
"roleAssignmentScope" : "group",
"role" : "dummy",
"roleDefinitionId" : "dummy",
"roleAssignmentId" : "dummy",
"principalId" : "dummy",
"principalType" : "dummy"
},
"scope" : "dummy",
"action" : "dummy"
},
"claims" : {
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" : "dummy",
"appid" : "dummy",
"http://schemas.microsoft.com/identity/claims/objectidentifier" : "dummy"
}
},
"customerID" : "dummy",
"correlationId" : "dummy",
"time" : "dummy",
"category" : "dummy",
"resultType" : "Failure",
"resultDescription": "dummy",
"durationMs" : "dummy",
"properties" : {
"eventCategory" : "Administrative",
"statusCode" : "OK"
}
}