corrected Schema from storage account and event hubs

Author: EdB-MSFT

articles/azure-monitor/essentials/activity-log-schema.md

@@ -832,7 +832,7 @@ Following is an example of an event using this schema:
     "records": [
         {
             "time": "2019-01-21T22:14:26.9792776Z",
-            "resourceId": "/subscriptions/s1/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841",
+            "resourceId": "/subscriptions/s1/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/123456112305841",
             "operationName": "microsoft.support/supporttickets/write",
             "category": "Write",
             "resultType": "Success",
@@ -841,32 +841,37 @@ Following is an example of an event using this schema:
             "callerIpAddress": "111.111.111.11",
             "correlationId": "c776f9f4-36e5-4e0e-809b-c9b3c3fb62a8",
             "identity": {
-                "authorization": {
-                    "scope": "/subscriptions/s1/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841",
-                    "action": "microsoft.support/supporttickets/write",
-                    "evidence": {
-                        "role": "Subscription Admin"
-                    }
-                },
+               "authorization": {
+                   "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-001/providers/Microsoft.Storage/storageAccounts/       msftstorageaccount",
+                   "action": "Microsoft.Storage/storageAccounts/listAccountSas/action",
+                   "evidence": {
+                       "role": "Azure Eventhubs Service Role",
+                       "roleAssignmentScope": "/subscriptions/00000000-0000-0000-0000-000000000000",
+                       "roleAssignmentId": "123abc2a6c314b0ab03a891259123abc",
+                       "roleDefinitionId": "123456789de042a6a64b29b123456789",
+                       "principalId": "abcdef038c6444c18f1c31311fabcdef",
+                       "principalType": "ServicePrincipal"
+                   }
+               },
                 "claims": {
                     "aud": "https://management.core.windows.net/",
-                    "iss": "https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/",
+                    "iss": "https://sts.windows.net/abcde123-86f1-41af-91ab-abcde1234567/",
                     "iat": "1421876371",
                     "nbf": "1421876371",
                     "exp": "1421880271",
                     "ver": "1.0",
                     "http://schemas.microsoft.com/identity/claims/tenantid": "00000000-0000-0000-0000-000000000000",
                     "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd",
-                    "http://schemas.microsoft.com/identity/claims/objectidentifier": "2468adf0-8211-44e3-95xq-85137af64708",
+                    "http://schemas.microsoft.com/identity/claims/objectidentifier": "123abc45-8211-44e3-95xq-85137af64708",
                     "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "[email protected]",
                     "puid": "20030000801A118C",
-                    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "9vckmEGF7zDKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM",
+                    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "9876543210DKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM",
                     "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John",
                     "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Smith",
                     "name": "John Smith",
-                    "groups": "cacfe77c-e058-4712-83qw-f9b08849fd60,7f71d11d-4c41-4b23-99d2-d32ce7aa621c,31522864-0578-4ea0-9gdc-e66cc564d18c",
+                    "groups": "12345678-cacfe77c-e058-4712-83qw-f9b08849fd60,12345678-4c41-4b23-99d2-d32ce7aa621c,12345678-0578-4ea0-9gdc-e66cc564d18c",
                     "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": " [email protected]",
-                    "appid": "c44b4083-3bq0-49c1-b47d-974e53cbdf3c",
+                    "appid": "12345678-3bq0-49c1-b47d-974e53cbdf3c",
                     "appidacr": "2",
                     "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
                     "http://schemas.microsoft.com/claims/authnclassreference": "1"
@@ -876,7 +881,7 @@ Following is an example of an event using this schema:
             "location": "global",
             "properties": {
                 "statusCode": "Created",
-                "serviceRequestId": "50d5cddb-8ca0-47ad-9b80-6cde2207f97c"
+                "serviceRequestId": "12345678-8ca0-47ad-9b80-6cde2207f97c"
             }
         }
     ]
@@ -885,8 +890,6 @@ Following is an example of an event using this schema:
 
 
 
-
-
 ## Next steps
 * [Learn more about the Activity Log](./platform-logs-overview.md)
 * [Create a diagnostic setting to send Activity Log to Log Analytics workspace, Azure storage, or event hubs](./diagnostic-settings.md)