Azure资源Graph查询无法获取创建人信息，求修正方案

我有一段Azure Graph查询，能正确筛选出无备份的指定类型Azure资源，但createdBy字段为空，无法获取创建资源的用户信息，希望有人帮忙修改查询以返回该字段。

初始查询代码 #

$startTime = [datetime]::UtcNow.AddHours(-$ThresholdHours).ToString('o')

$searchAzGraphSplat = @{
        Query = "
        resources
        | where type in (
            'microsoft.compute/virtualmachines',
            'microsoft.storage/storageaccounts/fileServices/shares',
            'microsoft.compute/disks',
            'microsoft.sql/servers/databases'
        )
        | extend backupPolicy = properties.backupPolicyId,
                  createdBy = coalesce(tostring(properties.createdBy.userPrincipalName), tostring(identity.principalId))
        | extend timeCreated = todatetime(properties.timeCreated)
        | where timeCreated > todatetime('$startTime')
        | where isnull(backupPolicy) or backupPolicy == ''
        | project name, type, location, resourceGroup, subscriptionId, timeCreated, createdBy
        "
    }


$result = @()
do {
    $response = Search-AzGraph @searchAzGraphSplat
    $searchAzGraphSplat['SkipToken'] = $response.SkipToken
    if ($response.Data) {
        $result += $response.Data
    }
} while ($response.SkipToken)

编辑更新：新版本代码 #

Try {


    $startTime = [datetime]::UtcNow.AddHours(-$ThresholdHours).ToString('o')


    $query = @'
resources
| where type in (
    'microsoft.compute/virtualmachines',
    'microsoft.storage/storageaccounts/fileServices/shares',
    'microsoft.compute/disks',
    'microsoft.sql/servers/databases'
)
| extend timeCreated = todatetime(coalesce(
    properties.timeCreated,
    properties.creationDate))
| where timeCreated > todatetime('{0}')
    and isempty(properties.backupPolicyId)
| join kind = leftouter (
    resourcechanges
    | where properties.changeType == 'Create'
    | extend createdTime = todatetime(properties.changeAttributes.timestamp)
    | where createdTime > todatetime('{0}')
    | project
        resourceId = tostring(properties.targetResourceId),
        createdBy = tostring(properties.changeAttributes.changedBy),
        createdByType = tostring(properties.changeAttributes.changedByType)
) on $left.id == $right.resourceId
| project
    name, type, location, resourceGroup,
    subscriptionId, timeCreated, createdBy, createdByType
'@ -f $startTime

$searchAzGraphSplat = @{ Query = $query }
$result = do {
    $response = Search-AzGraph @searchAzGraphSplat
    $searchAzGraphSplat['SkipToken'] = $response.SkipToken
    if ($response.Data) { $response.Data }
}
while ($response.SkipToken)
}

内容的提问来源于stack exchange，提问作者learner