Query extended events about login changes (creation, permissions, roles, ...)

audit-login-query.sql

declare  @LogFilePath varchar(255);
 
select
    @LogFilePath=log_file_path 
from
    sys.server_file_audits 
where
    name='Audit Login Changes';
 
set @LogFilePath=@LogFilePath +'*.sqlaudit';
 
select
    session_server_principal_name
    ,database_name
    ,object_name
    ,m.class_type_desc
    ,statement
    ,convert(datetime, 
        switchoffset(
            convert(datetimeoffset, event_time)
            , datename(TzOffset, sysdatetimeoffset())
        )
    ) 
from
    sys.fn_get_audit_file (@LogFilePath,default,default) f
inner join
    sys.dm_audit_class_type_map m
    on m.class_type=f.class_type
order by
    event_time;