@VolginRnB Thanks for reaching out. Yes, absolutely. The mv-expand operator and bag_unpack() plugin can be very useful utilities for handling dynamic data in KQL.
To replicate your requirement, I worked up the following query with some sample data having similar structure as shown in your screenshot above:
print dynamic_properties = dynamic(
[ { "tenantId": "t1", "objectId": "o1", "permissions": { "keys": [ "Get", "List", "Update", "Create", "Import", "Delete" ], "certificates": [ "Get", "List" ], "secrets": ["Get", "List", "Set", "Delete", "Recover"] }}, { "tenantId": "t2", "objectId": "o2", "permissions": { "keys": [ "Get", "List", "Update" ], "certificates": [ "Get" ], "secrets": ["Get", "List", "Set" ] }}
])
| mv-expand dynamic_properties
| mv-expand dynamic_properties.tenantId
| evaluate bag_unpack(dynamic_properties)
| evaluate bag_unpack(permissions)
| mv-expand keys, certificates, secrets
| project-away dynamic_properties_tenantId
This would produce output similar to the following:
Feel free to modify the query as required to suit your use-case.
Hope this helps. Do let us know if you have further questions.
----------
If an answer is helpful, please "Accept answer" and/or "Up-Vote" which might help other community members reading this thread.