AuditLogs
| where TargetResources has "domainofguest.com.au"
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| project TimeGenerated, OperationName, InitiatingUser, InitiatingApp, Result, TargetResources
| order by TimeGenerated asc

This will show you