Your organization uses Privileged Identity Management (PIM) for Entra ID roles. The security team wants to receive an automated alert whenever the Global Administrator role is activated outside normal business hours. You have already configured diagnostic settings to send Entra ID audit logs to a Log Analytics workspace. You need to build a query that detects these activation events so it can be used in an Azure Monitor alert rule. Which log table and operation should your KQL query target?